CVE-2025-12584

MediumCVSS 5.3

Published: 27/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This allows unauthenticated attackers to extract data from private products they should not access.

Risk Assessment

Confidential product information, such as prices or descriptions, that should be hidden may be disclosed.

Recommendation

Update the Quick View for WooCommerce plugin to a version later than 2.2.17.

Other vulnerabilities in Quick View for WooCommerce

CVE-2025-58228Medium
The Quick View for WooCommerce plugin up to version 2.2.16 contains a Stored XSS vulnerability. The issue arises from improper neutralization of input during web page generation.

Original NVD description (English source)

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS