CVE-2025-11735: HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the phrase parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11735?
CVE-2025-11735 has a high severity level, indicating a significant risk to affected installations.
How do I fix CVE-2025-11735?
To mitigate CVE-2025-11735, update the HUSKY Products Filter Professional for WooCommerce plugin to the latest version beyond 1.3.7.1.
What is the impact of CVE-2025-11735?
CVE-2025-11735 allows for blind SQL Injection, potentially enabling unauthorized access to the database.
Which versions of HUSKY Products Filter Professional for WooCommerce are affected by CVE-2025-11735?
All versions of HUSKY Products Filter Professional for WooCommerce up to and including 1.3.7.1 are affected by CVE-2025-11735.
Is there a workaround for CVE-2025-11735 if I cannot update immediately?
There is no official workaround for CVE-2025-11735, so immediate updating is recommended to prevent exploitation.