Perfect Woocommerce Brands Vulnerabilities

The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query....

CVSS:

6.5

Affected:

up to 3.6.2

Fixed in:

3.6.3

Disclosed:

Nov 24, 2025

CVE-2025-10144 on NVD →

[en] The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL que...

Affected:

up to 3.6.3

Fixed in:

3.6.3

Disclosed:

Nov 24, 2025

CVE-2025-10144 on NVD →

The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-le...

CVSS:

6.5

Affected:

up to 3.6.2

Fixed in:

3.6.3

Disclosed:

Sep 22, 2025

CVE-2025-58686 on NVD →

[en] The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).

Affected:

up to 2.0.5

Fixed in:

2.0.5

Disclosed:

Feb 18, 2022

CVE-2022-23981 on NVD →

[en] The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.

Affected:

up to 2.0.5

Fixed in:

2.0.5

Disclosed:

Feb 18, 2022

CVE-2022-23982 on NVD →

The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.

CVSS:

4.3

Affected:

up to 2.0.4

Fixed in:

2.0.5

Disclosed:

Jan 28, 2022

CVE-2022-23982 on NVD →

The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).

CVSS:

4.3

Affected:

up to 2.0.4

Fixed in:

2.0.5

Disclosed:

Jan 28, 2022

CVE-2022-23981 on NVD →

Create Brands vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.2).

Affected:

up to 2.0.3

Fixed in:

2.0.3

Disclosed:

Jan 11, 2022

Non-Arbitrary Media File Upload vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.2).

Affected:

up to 2.0.3

Fixed in:

2.0.3

Disclosed:

Jan 11, 2022

Affected:

up to 3.6.2

Fix:

No patched version reported

CVE-2025-58686 on NVD →