CVE-2025-11741

MediumCVSS 5.3

Published: 18/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

The WPC Smart Quick View for WooCommerce plugin for WordPress, up to version 4.2.5, is vulnerable to information exposure via the 'woosq_quickview' AJAX endpoint. Insufficient restrictions allow unauthenticated attackers to extract data from password-protected, private, or draft products.

Risk Assessment

An unauthenticated attacker can access confidential product information that should be hidden, potentially leading to privacy breaches or data leaks.

Recommendation

Update the plugin to a version newer than 4.2.5 that includes a fix restricting access to the AJAX endpoint.

Other vulnerabilities in WPC Smart Quick View for WooCommerce

CVE-2026-103888Medium
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0. An unauthenticated attacker can inject arbitrary web scripts if they can trick a user into clicking a link.

Original NVD description (English source)

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS