5.3 Medium

CVE-2025-12584 The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and…

Description

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to.

Affected products and versions

Product	Affected versions	Fixed in
Quick View for WooCommerce 2.2	earliest → 2.2.17	No fix stated

Do you use Quick View for WooCommerce?

Track this CVE Watch Quick View for WooCommerce Check my SBOMs

www.cveye.io/en/cve/CVE-2025-12584

Timeline

Published November 27, 2025
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE