CVE-2026-125814 · Package
NO FIX YET
Product Feed PRO for WooCommerce does not neutralize script-related HTML tags in a web page, so injected code can run in a visitor's browser. The affected versions are listed as n/a through 13.5.8.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Product Feed PRO for WooCommerce WordPress plugin at or below version 13.5.8 may be exposed. The description does not say which inputs or pages are involved, or whether logged-in access is needed. Sites that do not run this plugin can skip it.
Not affected if plugin-not-installed
Who cares product-feed-pro, woocommerce, wordpress
woo-product-feed-pro).13.5.8.No fix yet, per the sources.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Code Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.8.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.