Advisories · Technology
themeisle PPOM – Product Addons & Custom Fields for WooCommerce.
Every CVE that names themeisle PPOM – Product Addons & Custom Fields for WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
- themeisle PPOM – Product Addons & Custom Fields for WooCommerce
- Path traversal
- CVSS 7.5 High
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection
- themeisle PPOM – Product Addons & Custom Fields for WooCommerce
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
- themeisle PPOM – Product Addons & Custom Fields for WooCommerce
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · CVSS 9+
Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
- themeisle PPOM – Product Addons & Custom Fields for WooCommerce
- Unrestricted file upload
- CVSS 5.3 Medium
ThemeIsle SDK <= Various Versions - Missing Authorization
- Menu Icons by ThemeIsle
- themeisle Starter Sites & Templates by Neve
- Broken access control