Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Private WooCommerce Product Data Leaked via Quick View Plugin

CVE-2025-12584 · published 11 months ago
Summary

Any attacker can view private product information in WooCommerce stores using an affected version of the Quick View plugin. This is a security risk because sensitive information can be exposed to unauthorized individuals. Update the Quick View for WooCommerce plugin to a version higher than 2.2.17 to fix this issue.

Original advisory text
The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient ...
The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published27 Nov 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-12584 · NVD
Track software like this
Free during beta