CVE-2025-1661

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

• CWE-22

• https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_text/index.phpProduct
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249621%40woocommerce-products-filter&new=3249621%40woocommerce-products-filter&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253169%40woocommerce-products-filter&new=3253169%40woocommerce-products-filter&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae7b6fc-2120-4573-8b1b-d5422d435fa5?source=cveThird Party Advisory

Published

Mar 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1653The Directory Listings WordPress plugin – uListing plugin fo…8.8
• CVE-2025-1656A maliciously crafted PDF file, when linked or imported into…7.8
• CVE-2025-1657The Directory Listings WordPress plugin – uListing plugin fo…8.8
• CVE-2025-1658A maliciously crafted DWFX file, when parsed through Autodes…7.8
• CVE-2025-1659A maliciously crafted DWFX file, when parsed through Autodes…7.8
• CVE-2025-1660A maliciously crafted DWFX file, when parsed through Autodes…7.8
• CVE-2025-1662The URL Media Uploader plugin for WordPress is vulnerable to…6.4
• CVE-2025-1663The Unlimited Elements For Elementor plugin for WordPress is…5.4
• CVE-2025-1664The Essential Blocks – Page Builder Gutenberg Blocks, Patter…5.4
• CVE-2025-1665The Avada (Fusion) Builder plugin for WordPress is vulnerabl…5.4
• CVE-2025-1666The Cookie banner plugin for WordPress – Cookiebot CMP by Us…4.3
• CVE-2025-1667The School Management System – WPSchoolPress plugin for Word…4.3