# PluginUs.Net vulnerabilities Source: https://junglewise.ai/threats/vendors/pluginus-net Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/pluginus-net.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in PluginUs.Net: 2 in the last 7 days and 12 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123461, was published on 7 November 2026. 9 vulnerabilities in the last four weeks, up 350% on the four before (2). 2 technologies have a page of their own. ## Counts - Last 7 days: 2 - Last 30 days: 6 - Last 90 days: 12 - All time: 19 (2 critical, 0 exploited in the wild) ## About PluginUs.Net A software development team specializing in WordPress plugins for e-commerce and data management. ## Latest PluginUs.Net vulnerabilities - [CVE-2026-123461: PluginUs.Net FOX woocommerce-currency-switcher broken access control](https://junglewise.ai/threats/cve-2026-123461-missing-authorization-vulnerability-in-pluginus-net-fox) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-123183: PluginUs.Net Active Products Tables for WooCommerce XSS code injection](https://junglewise.ai/threats/cve-2026-123183-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-116401: HUSKY WordPress plugin broken access control](https://junglewise.ai/threats/cve-2026-116401-unauthenticated-broken-access-control-in-husky-1-4-6-versions) (high, CVSS 7.5, published 30 Oct 2026) - [CVE-2026-115947: HUSKY WordPress plugin sensitive data exposure](https://junglewise.ai/threats/cve-2026-115947-unauthenticated-sensitive-data-exposure-in-husky-1-4-6-versions) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-115611: PluginUs.Net TableOn reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-115611-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 29 Oct 2026) - [CVE-2026-108151: WordPress MDTF Meta Data Filter code injection](https://junglewise.ai/threats/cve-2026-108151-improper-control-of-generation-of-code-code-injection) (medium, CVSS 5.3, published 14 Oct 2026) - [CVE-2026-108489: Active Products Tables for WooCommerce sensitive data exposure](https://junglewise.ai/threats/cve-2026-108489-insertion-of-sensitive-information-into-sent-data-vulnerability) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-108179: PluginUs.Net WOLF SQL injection in bulk-editor](https://junglewise.ai/threats/cve-2026-108179-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 7.6, published 13 Oct 2026) - [CVE-2026-108174: PluginUs.Net FOX woocommerce-currency-switcher broken access control](https://junglewise.ai/threats/cve-2026-108174-missing-authorization-vulnerability-in-pluginus-net-fox) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-95608: PluginUs.Net HUSKY woocommerce-products-filter reflected XSS](https://junglewise.ai/threats/cve-2026-95608-improper-neutralization-of-input-during-web-page-generation-cross) (high, CVSS 7.1, published 9 Oct 2026) - [CVE-2026-95526: BEAR WordPress plugin broken access control](https://junglewise.ai/threats/cve-2026-95526-unauthenticated-broken-access-control-in-bear-1-2-2-versions) (high, CVSS 7.3, published 6 Oct 2026) - [CVE-2026-84816: WordPress WPCS plugin unauthenticated XSS](https://junglewise.ai/threats/cve-2026-84816-wordpress-wpcs-plugin-unauthenticated-xss) (high, CVSS 7.1, published 10 Sep 2026) - [CVE-2026-57320: RealMag777 BEAR unauthenticated XSS in WooCommerce Bulk Editor](https://junglewise.ai/threats/cve-2026-57320-realmag777-bear-unauthenticated-xss-in-woocommerce-bulk-editor) (high, CVSS 7.1, published 29 Jun 2026) - [CVE-2026-54845: PluginUs.Net MDTF unauthenticated local file inclusion](https://junglewise.ai/threats/cve-2026-54845-pluginus-net-mdtf-unauthenticated-local-file-inclusion) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-54843: PluginUs.Net MDTF unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-54843-pluginus-net-mdtf-unauthenticated-sql-injection) (critical, CVSS 9.3, published 25 Jun 2026) - [CVE-2026-42733: RealMag777 WPCS currency-switcher DOM-based XSS](https://junglewise.ai/threats/cve-2026-42733-realmag777-wpcs-currency-switcher-dom-based-xss) (high, CVSS 7.1, published 27 May 2026) - [CVE-2026-42727: RealMag777 Active Products Tables for WooCommerce SQL injection](https://junglewise.ai/threats/cve-2026-42727-realmag777-active-products-tables-for-woocommerce-sql-injection) (critical, CVSS 9.3, published 27 May 2026) - [CVE-2026-1673: Pluginus.Net BEAR Bulk Editor CSRF in woobe_delete_tax_term](https://junglewise.ai/threats/cve-2026-1673-pluginus-net-bear-bulk-editor-csrf-in-woobe-delete-tax-term) (medium, CVSS 4.3, published 8 Apr 2026) - [CVE-2026-1672: Pluginus.Net BEAR Bulk Editor CSRF in woobe_redraw_table_row](https://junglewise.ai/threats/cve-2026-1672-pluginus-net-bear-bulk-editor-csrf-in-woobe-redraw-table-row) (medium, CVSS 6.5, published 8 Apr 2026) ## Most severe PluginUs.Net vulnerabilities - [CVE-2026-54843: PluginUs.Net MDTF unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-54843-pluginus-net-mdtf-unauthenticated-sql-injection) (critical, CVSS 9.3, published 25 Jun 2026) - [CVE-2026-42727: RealMag777 Active Products Tables for WooCommerce SQL injection](https://junglewise.ai/threats/cve-2026-42727-realmag777-active-products-tables-for-woocommerce-sql-injection) (critical, CVSS 9.3, published 27 May 2026) - [CVE-2026-54845: PluginUs.Net MDTF unauthenticated local file inclusion](https://junglewise.ai/threats/cve-2026-54845-pluginus-net-mdtf-unauthenticated-local-file-inclusion) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-108179: PluginUs.Net WOLF SQL injection in bulk-editor](https://junglewise.ai/threats/cve-2026-108179-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 7.6, published 13 Oct 2026) - [CVE-2026-116401: HUSKY WordPress plugin broken access control](https://junglewise.ai/threats/cve-2026-116401-unauthenticated-broken-access-control-in-husky-1-4-6-versions) (high, CVSS 7.5, published 30 Oct 2026) - [CVE-2026-95526: BEAR WordPress plugin broken access control](https://junglewise.ai/threats/cve-2026-95526-unauthenticated-broken-access-control-in-bear-1-2-2-versions) (high, CVSS 7.3, published 6 Oct 2026) - [CVE-2026-84816: WordPress WPCS plugin unauthenticated XSS](https://junglewise.ai/threats/cve-2026-84816-wordpress-wpcs-plugin-unauthenticated-xss) (high, CVSS 7.1, published 10 Sep 2026) - [CVE-2026-95608: PluginUs.Net HUSKY woocommerce-products-filter reflected XSS](https://junglewise.ai/threats/cve-2026-95608-improper-neutralization-of-input-during-web-page-generation-cross) (high, CVSS 7.1, published 9 Oct 2026) - [CVE-2026-115611: PluginUs.Net TableOn reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-115611-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 29 Oct 2026) - [CVE-2026-57320: RealMag777 BEAR unauthenticated XSS in WooCommerce Bulk Editor](https://junglewise.ai/threats/cve-2026-57320-realmag777-bear-unauthenticated-xss-in-woocommerce-bulk-editor) (high, CVSS 7.1, published 29 Jun 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 350% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## PluginUs.Net technologies - [PluginUs.Net Active Products Tables for WooCommerce](https://junglewise.ai/threats/technologies/active-products-tables-for-woocommerce): 3 vulnerabilities - [PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce](https://junglewise.ai/threats/technologies/bear-bulk-editor-and-products-manager-professional-for-woocommerce): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "PluginUs.Net vulnerabilities", https://junglewise.ai/threats/vendors/pluginus-net, 13 November 2026.