Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2021-4337: Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing c

53
This month
HIGH 8.8UPGRADEUPGRADEUPGRADE

CVE-2021-4337 is a high-severity flaw (CVSS 8.8) affecting add product tabs, autopilot seo, bulk add to cart. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Produc

Why this priority

  • High severity
  • Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score8.8 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance1.3% (top 30%)
CISA exploited listNo
WeaknessCWE-862
Published2023-06-07
Last modified2026-06-17
Publisher (CNA): Wordfence · Vendor: xforwoocommerce

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

xforwoocommerce add product tabs UPGRADE
Affected: < 1.5.0
Fixed in: 1.5.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy add-product-tabs || rpm -q add-product-tabs || add-product-tabs --version
2. UPGRADE to 1.5.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade add-product-tabs
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade add-product-tabs
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
xforwoocommerce autopilot seo UPGRADE
Affected: < 1.6.0
Fixed in: 1.6.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy autopilot-seo || rpm -q autopilot-seo || autopilot-seo --version
2. UPGRADE to 1.6.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade autopilot-seo
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade autopilot-seo
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
xforwoocommerce bulk add to cart UPGRADE
Affected: < 1.3.0
Fixed in: 1.3.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy bulk-add-to-cart || rpm -q bulk-add-to-cart || bulk-add-to-cart --version
2. UPGRADE to 1.3.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade bulk-add-to-cart
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade bulk-add-to-cart
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
xforwoocommerce comment and review spam control UPGRADE
Affected: < 1.5.0
Fixed in: 1.5.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy comment-and-review-spam-control || rpm -q comment-and-review-spam-control || comment-and-review-spam-control --version
2. UPGRADE to 1.5.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade comment-and-review-spam-control
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade comment-and-review-spam-control
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
xforwoocommerce floating cart UPGRADE
Affected: < 1.3.0
Fixed in: 1.3.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy floating-cart || rpm -q floating-cart || floating-cart --version
2. UPGRADE to 1.3.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade floating-cart
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade floating-cart
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
xforwoocommerce improved product options UPGRADE
Affected: < 5.3.0
Fixed in: 5.3.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy improved-product-options || rpm -q improved-product-options || improved-product-options --version
2. UPGRADE to 5.3.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade improved-product-options
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade improved-product-options
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-4337?

add product tabs: upgrade to 1.5.0; autopilot seo: upgrade to 1.6.0; bulk add to cart: upgrade to 1.3.0. Exact commands for each OS are on this page.

Is CVE-2021-4337 being exploited?

CVE-2021-4337 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-4337 affect?

CVE-2021-4337 affects add product tabs, autopilot seo, bulk add to cart. Severity is high (CVSS 8.8). Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticate

How urgent is CVE-2021-4337?

Priority 53/100. High severity; Public exploit reference

Software pages

WordPress vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.