themeisle PPOM – Product Addons & Custom Fields for WooCommerce vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Latest themeisle PPOM – Product Addons & Custom Fields for WooCommerce vulnerabilities

CVE-2026-104801 — PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter (CVSS 9.1)
CVE-2026-56050 — WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability (CVSS 6.5)
CVE-2025-66069 — WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability (CVSS 4.3)
CVE-2025-11691 — PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection (CVSS 7.5)
CVE-2025-11391 — PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
CVE-2025-24668 — WordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
CVE-2024-35728 — WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability (CVSS 5.3)
CVE-2024-3962 — Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file (CVSS 9.8)
CVE-2023-2256 — Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting (CVSS 6.1)
CVE-2023-1839 — Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)