Medium severity · published Dec 18, 2025
CVE-2025-13110
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr'
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
HUSKY – Products Filter Professional for WooCommerce · realmag777
through 1.3.7.3 · source: vendor
Affected product
HP
HUSKY – Products Filter Professional for WooCommerce
realmag777
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13110
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3412492/woocommerce-products-filter
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3415428/woocommerce-products-filter
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea2dfc5-0dcc-4ea1-9ade-d59021e078fa?source=cve
More from HUSKY – Products Filter Professional for WooCommerce
7.5
CVE-2025-11735
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter
4.3
CVE-2025-13109
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'