Skip to content
OpenAdvisories
Critical · 9.9 CVE-2025-49887 EUVD-2025-24778GHSA-56m6-w8wr-xj4x

WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability

Published Aug 14, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.3.

Affected products

VendorProductAffectedFixed
WPFactory Product XML Feed Manager for WooCommerce ≤ 2.9.3 —

References