CVE-2025-13109

MediumCVSS 4.3

Published: 03/12/2025(UTC)Updated: 18/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user-controlled key. This makes it possible for authenticated attackers with subscriber-level access and above to insert or remove arbitrary saved search queries into any user's profile, including administrators.

Risk Assessment

A low-privileged attacker can modify other users' saved search queries, including administrators', potentially leading to unexpected behavior or further attacks. This compromises data integrity in user profiles.

Recommendation

Update the HUSKY plugin to a version later than 1.3.7.2. Until then, consider restricting access to the saved queries feature or disabling the plugin.

Other vulnerabilities in HUSKY – Products Filter Professional for WooCommerce

CVE-2026-18562Medium
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes.

Original NVD description (English source)

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS