3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
critical
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POS...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 2.16.2
- Fixed in:
- 2.16.3
- Disclosed:
- Oct 9, 2026
CVE-2026-103889 on NVD →
Product Configurator for WooCommerce <= 1.2.31 - Arbitrary File Deletion
medium
The Product Configurator for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletions in versions up to, and including, 1.2.31 due to insufficient file validation and file path validation on the save_image() function that uses unlink() on a user supplied file path. This function is invoked via the wp_...
- CVSS:
- 5.4
(Wordfence)
- Affected:
- up to 1.0.5
- Fixed in:
- 1.0.6
- Disclosed:
- Jun 1, 2022
CVE-2022-1953 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database