Product Filter for WooCommerce by WBW vulnerabilities

The Product Filter for WooCommerce by WBW plugin is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' JSON parameter in versions up to 3.4.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.

The Product Filter for WooCommerce by WBW plugin is vulnerable to Missing Authorization / Information Disclosure in versions up to 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.

Reflected Cross-Site Scripting (XSS) vulnerability in the Product Filter for WooCommerce by WBW plugin for WordPress, all versions up to and including 3.4.2, due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts if a user clicks a crafted link.