Plugin icon

PPOM – Product Addons & Custom Fields for WooCommerce

woocommerce-product-addon

Vulnerabilities:

11

Last Updated:

March 16, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2025-11-17
Title
PPOM for WooCommerce < 33.0.17 - Missing Authorization
Fixed in
Fixed in 33.0.17
CVSS
4.3 (medium)
Published
2025-10-17
Title
PPOM – Product Addons & Custom Fields for WooCommerce < 33.0.16 - Unauthenticated SQL Injection
Fixed in
Fixed in 33.0.16
CVSS
7.5 (high)
Published
2025-10-17
Title
PPOM – Product Addons & Custom Fields for WooCommerce < 33.0.16 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 33.0.16
CVSS
9.8 (critical)
Published
2025-01-24
Title
PPOM for WooCommerce < 33.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 33.0.9
CVSS
4.4 (medium)
Published
2024-06-06
Title
PPOM for WooCommerce < 32.0.21 - Unauthenticated Content Injection Vulnerability
Fixed in
Fixed in 32.0.21
CVSS
5.3 (medium)
Published
2024-04-25
Title
Product Addons & Fields for WooCommerce < 32.0.19 - Unauthenticated Arbitrary File Upload via ppom_upload_file
Fixed in
Fixed in 32.0.19
CVSS
9.8 (critical)
Published
2023-05-01
Title
Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting
Fixed in
Fixed in 32.0.7
CVSS
7.1 (high)
Published
2023-04-24
Title
Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 32.0.6
CVSS
3.5 (low)
Published
2022-01-17
Title
PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS
Fixed in
Fixed in 24.0
CVSS
6.4 (medium)
Published
2019-08-10
Title
PPOM for WooCommerce <= 18.3 - Authenticated Stored XSS
Fixed in
Fixed in 18.4
CVSS
5.4 (medium)
Published
2016-09-19
Title
WooCommerce Product Addons < 2.0 - Arbitrary File Upload
Fixed in
Fixed in 2.0
CVSS
n/a