WordPress plugin
PPOM – Product Addons & Custom Fields for WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High1
- Medium9
- Low0
All PPOM – Product Addons & Custom Fields for WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.1 | Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter ≤34.0.10Update to 34.0.11 | CVE-2026-104801 | |
| Medium5.3 | Missing Authorization ≤33.0.18Update to 34.0.0 | CVE-2026-56050 | |
| Medium4.3 | Missing Authorization ≤33.0.16Update to 33.0.17 | CVE-2025-66069 | |
| High7.5 | Unauthenticated SQL Injection ≤33.0.15Update to 33.0.16 | CVE-2025-11691 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤33.0.15Update to 33.0.16 | CVE-2025-11391 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤33.0.8Update to 33.0.9 | CVE-2025-24668 | |
| Medium5.3 | Unauthenticated Content Injection Vulnerability ≤32.0.20Update to 32.0.21 | CVE-2024-35728 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via ppom_upload_file ≤32.0.18Update to 32.0.19 | CVE-2024-3962 | |
| Medium5.3 | Missing Authorization ≤2.6.9Update to 2.6.10 | CVE-2024-1047 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings <32.0.6Update to 32.0.6 | CVE-2023-1839 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤32.0.6Update to 32.0.7 | CVE-2023-2256 | |
| Medium5.4 | Missing Authorization to Stored Cross-Site Scripting ≤23.9Update to 24.0 | CVE-2021-25018 | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting <18.4Update to 18.4 | CVE-2019-14948 | |
| Critical9.8 | Arbitrary File Upload ≤1.1Update to 2.0 | — |
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
≤34.0.10Update to 34.0.11
- Medium5.3Missing Authorization
≤33.0.18Update to 34.0.0
- Medium4.3Missing Authorization
≤33.0.16Update to 33.0.17
- High7.5Unauthenticated SQL Injection
≤33.0.15Update to 33.0.16
- Critical9.8Unauthenticated Arbitrary File Upload
≤33.0.15Update to 33.0.16
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤33.0.8Update to 33.0.9
- Medium5.3Unauthenticated Content Injection Vulnerability
≤32.0.20Update to 32.0.21
- Critical9.8Unauthenticated Arbitrary File Upload via ppom_upload_file
≤32.0.18Update to 32.0.19
- Medium5.3Missing Authorization
≤2.6.9Update to 2.6.10
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
<32.0.6Update to 32.0.6
- Medium6.1Reflected Cross-Site Scripting
≤32.0.6Update to 32.0.7
- Medium5.4Missing Authorization to Stored Cross-Site Scripting
≤23.9Update to 24.0
- Medium5.4Authenticated Stored Cross-Site Scripting
<18.4Update to 18.4
- Critical9.8Arbitrary File Upload
≤1.1Update to 2.0
PPOM – Product Addons & Custom Fields for WooCommerce: common questions
Does PPOM – Product Addons & Custom Fields for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in PPOM – Product Addons & Custom Fields for WooCommerce: 4 critical, 1 high, 9 medium. None are known to affect version null.
How do I check which version of PPOM – Product Addons & Custom Fields for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent PPOM – Product Addons & Custom Fields for WooCommerce vulnerability?
CVE-2026-104801, published Oct 9, 2026: PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter. Severity: Critical (CVSS 9.1).
Is any PPOM – Product Addons & Custom Fields for WooCommerce vulnerability listed in CISA KEV?
No. None of the known PPOM – Product Addons & Custom Fields for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.