CVE-2026-87964High· 7.2▾ TwilightThe Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitiza…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
1.4%
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wp_unslash() is applied before the value is stored verbatim via update_option(), and during feed generation the Custom2Template::evaluate_return() method passes the stored {(return ...)} template expressions directly to PHP's eval() function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The ctxfeed_custom2_eval_enabled option defaults to true, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
product_feed_manager_for_woocommerce_ctx_feed_support_220+_shopping_ai_social_channels <= 8.0.26Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15095Medium· 4.9The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter
CVE-2025-11905Medium· 6.3A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-10097Medium· 6.3A vulnerability was identified in SimStudioAI sim up to 1.0.0
CVE-2025-13786High· 7.3A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
CVE-2022-34821High· 7.6A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB (6GK5804-0AP00-2AA2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2), SCALANCE …
CVE-2023-3519Critical· 9.8Unauthenticated remote code execution