VulnerabilityDeferred

CVE-2025-10046

EXPLOITMEDIUM 4.9EPSS 0.74%

Does this matter?

A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is medium and EPSS is 0.7%. Treat it as high on anything reachable from the internet.

Description

The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1: 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.74% probability · 54th percentile
Public exploits: 1 in Exploit-DB · first 16 September 2025
CISA KEV: Not listed
Weakness: CWE-89
Source: security@wordfence.com

EPSS trend

EPSS 0.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

Public exploits (1)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-52430 source ↗	ELEX WooCommerce WordPress Plugin 1.4.3 - SQL Injectionmultiple · Byte Reaper	webapps	16 September 2025	no

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.