CVE-2021-4337
Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization
- Published
- Updated
- Reserved
- Assigned by
- Wordfence
Description
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WordfenceCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.3% · top 30% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
Affected products
XforWooCommerce · Package Quantity Discount
- affected < 1.2.0
XforWooCommerce · Price Commander for WooCommerce
- affected < 1.3.0
XforWooCommerce · Bulk Add to Cart for WooCommerce
- affected < 1.3.0
XforWooCommerce · Floating Cart for WooCommerce
- affected < 1.3.0
XforWooCommerce · Comment and Review Spam Control for WooCommerce
- affected < 1.5.0
XforWooCommerce · Add Product Tabs for WooCommerce
- affected < 1.5.0
XforWooCommerce · Autopilot SEO for WooCommerce
- affected < 1.6.0
XforWooCommerce · XforWooCommerce
- affected < 1.7.0
XforWooCommerce · Product Loops for WooCommerce
- affected < 1.7.0
XforWooCommerce · Live Search for WooCommerce
- affected < 2.1.0
XforWooCommerce · Share, Print and PDF Products for WooCommerce
- affected < 2.8.0
XforWooCommerce · Improved Sale Badges for WooCommerce
- affected < 4.4.0
XforWooCommerce · Live Product Editor for WooCommerce
- affected < 4.7.0
XforWooCommerce · Warranties and Returns for WooCommerce
- affected < 5.3.0
XforWooCommerce · Improved Product Options for WooCommerce
- affected < 5.3.0
XforWooCommerce · Product Filter for WooCommerce
- affected < 8.2.0
References (3)
- https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve (opens in a new tab)x_transferred
- https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/ (opens in a new tab)x_transferred
- https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/ (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-4337)Record last updated .