WordPress plugin
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High2
- Medium5
- Low1
All Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.6 | Authenticated (Shop Manager+) PHP Object Injection ≤7.14.1Update to 7.14.2 | CVE-2026-118089 | |
| Medium5.3 | Missing Authorization ≤7.14.1Update to 7.14.2 | CVE-2026-118093 | |
| Medium6.5 | Authenticated (Contributor+) SQL Injection ≤7.12.0Update to 7.12.1 | CVE-2026-66580 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤7.6.1Update to 7.6.2 | CVE-2026-59553 | |
| Medium6.1 | Reflected Cross-Site Scripting via 's' Search Parameter ≤7.6.1Update to 7.6.2 | CVE-2026-15306 | |
| Medium6.5 | Authenticated (Contributor+) SQL Injection ≤7.6.0Update to 7.6.1 | CVE-2026-15258 | |
| Low2.7 | Authenticated (Admin+) Directory Traversal ≤7.3.15Update to 7.3.16 | CVE-2023-52144 | |
| High8.8 | Missing Authorization to Arbitrary Options Update <3.1.7Update to 3.1.7 | — |
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
≤7.14.1Update to 7.14.2
- Medium5.3Missing Authorization
≤7.14.1Update to 7.14.2
- Medium6.5Authenticated (Contributor+) SQL Injection
≤7.12.0Update to 7.12.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤7.6.1Update to 7.6.2
- Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
≤7.6.1Update to 7.6.2
- Medium6.5Authenticated (Contributor+) SQL Injection
≤7.6.0Update to 7.6.1
- Low2.7Authenticated (Admin+) Directory Traversal
≤7.3.15Update to 7.3.16
- High8.8Missing Authorization to Arbitrary Options Update
<3.1.7Update to 3.1.7
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels: common questions
Does Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels: 2 high, 5 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels vulnerability?
CVE-2026-118089, published Oct 30, 2026: Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.14.1 - Authenticated (Shop Manager+) PHP Object Injection. Severity: Medium (CVSS 6.6).
Is any Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels vulnerability listed in CISA KEV?
No. None of the known Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels vulnerabilities is currently listed in the CISA KEV catalog.