tadrik Free store check

Plugin security / HUSKY Products Filter for WooCommerce

HUSKY Products Filter for WooCommerce vulnerability: is your WooCommerce store affected?

HUSKY Products Filter for WooCommerce has 13 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 30 October 2026. Every one is fixed: update to 1.4.7 or newer.

Short answer: your store is affected if it runs HUSKY Products Filter for WooCommerce older than 1.4.7. Update to 1.4.7 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 31 were running a version of HUSKY Products Filter for WooCommerce with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)no login neededAffected: older than 1.4.7Fixed in 1.4.7Published 30 October 2026CVE-2026-116401

    Advisory: Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

  2. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.4.4Fixed in 1.4.4Published 9 October 2026CVE-2026-95608

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through...

  3. File inclusion

    Someone could make the plugin load files it shouldn't, which can expose data or run code.

    Score 8.1 (high)no login neededAffected: older than 1.4.5Fixed in 1.4.5Published 10 September 2026CVE-2026-92969

    Advisory: The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter.

  4. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 1.3.7.2Fixed in 1.3.7.2Published 27 October 2025CVE-2025-11735

    Advisory: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping...

  5. File inclusion

    Someone could make the plugin load files it shouldn't, which can expose data or run code.

    Score 7.5 (high)needs only a customer accountAffected: older than 1.3.7.1Fixed in 1.3.7.1Published 19 June 2025CVE-2025-52708

    Advisory: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY allows PHP Local File Inclusion.

  6. File inclusion

    Someone could make the plugin load files it shouldn't, which can expose data or run code.

    Score 7.5 (high)needs only a customer accountAffected: older than 1.3.6.5Fixed in 1.3.6.5Published 14 March 2025CVE-2025-26890

    Advisory: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects...

  7. File inclusion

    Someone could make the plugin load files it shouldn't, which can expose data or run code.

    Score 9.8 (critical)no login neededAffected: older than 1.3.6.6Fixed in 1.3.6.6Published 10 March 2025CVE-2025-1661

    Advisory: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search...

  8. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 1.3.6.1Fixed in 1.3.6.1Published 15 July 2024CVE-2024-6457

    Advisory: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient...

  9. Code execution

    Someone could run their own code on your server.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.3.5.3Fixed in 1.3.5.3Published 17 April 2024CVE-2024-32680

    Advisory: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly...

  10. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.3.5.3Fixed in 1.3.5.3Published 14 March 2024CVE-2024-1795

    Advisory: The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to...

  11. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.3 (critical)no login neededAffected: older than 1.3.4.3Fixed in 1.3.4.3Published 27 November 2023CVE-2023-40010

    Advisory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional.This issue affects HUSKY – Products Filter for...

2 older holes, published before 1 January 2023

Some of these show a fixed version higher than 1.4.7: HUSKY Products Filter for WooCommerce used different version numbers back then.

  1. Code execution

    Someone could run their own code on your server.

    Score 9.8 (critical)no login neededAffected: older than 1.2.0Fixed in 1.2.0Published 6 March 2018CVE-2018-8710

    Advisory: A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action.

  2. File inclusion

    Someone could make the plugin load files it shouldn't, which can expose data or run code.

    Score 9.8 (critical)no login neededAffected: older than 2.2.0Fixed in 2.2.0Published 6 March 2018CVE-2018-8711

    Advisory: A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find HUSKY Products Filter for WooCommerce. The version number is under its name. If it is lower than 1.4.7, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/woocommerce-products-filter/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update HUSKY Products Filter for WooCommerce to 1.4.7 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use HUSKY Products Filter for WooCommerce.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use HUSKY Products Filter for WooCommerce, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which HUSKY Products Filter for WooCommerce version fixes it?
Version 1.4.7 or newer fixes all 13 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs HUSKY Products Filter for WooCommerce older than 1.4.7. In WordPress, open Plugins and read the version under HUSKY Products Filter for WooCommerce. Without logging in, open yourstore.com/wp-content/plugins/woocommerce-products-filter/readme.txt and read the Stable tag line.
I don't use HUSKY Products Filter for WooCommerce any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.