WordPress WooCommerce Customers Manager plugin < 29.8 - Subscriber+ Email Disclosure vulnerability

Subscriber+ Email Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WooCommerce Customers Manager versions 29.8...

WordPress WooCommerce Customers Manager plugin < 29.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WooCommerce Customers Manager versions 29.8...

CVE-2024-1756

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...

CVE-2024-1756

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...

CVE-2024-1743

The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-1756

CVE-2024-1756 affects the WooCommerce Customers Manager WordPress plugin, prior to version 29.8, due to missing authorization and CSRF protections in an AJAX action. This allows any authenticated user (e.g., a subscriber) to call the action and exfiltrate customer data including email addresses, ...

CVE-2024-1743 WooCommerce Customers Manager < 29.8 - Reflected XSS

The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-1756 WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...

CVE-2024-1743 WooCommerce Customers Manager < 29.8 - Reflected XSS

The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress WooCommerce Customers Manager Plugin < 29.8 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 29.8 Fixed in 29.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1743 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 088073d3e0c4 Credits Erwan LR...

WordPress plugin WooCommerce Customers Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WooCommerce Customers Manager Plugin < 29.8 is vulnerable to Broken Access Control

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 29.8 Fixed in 29.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1756 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0498a02d44dc Credits Erwan LR WPScan...

WordPress plugin WooCommerce Customers Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-18279 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 29.8 Description: The issue concerns a lack of authorization and CSRF protection in an AJAX action, allowing any authenticated user to retrieve a list of customer email addresse...

PT-2024-18268 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 29.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape various parameters before...

WordPress WooCommerce Customers Manager plugin < 29.7 - Subscriber+ SQL Injection vulnerability

Subscriber+ SQL Injection vulnerability discovered by Ivan Spiridonov in WordPress Plugin WooCommerce Customers Manager versions 29.7...

CVE-2024-0399

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role...

CVE-2024-0399

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role...

CVE-2024-0399 WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role...

CVE-2024-0399 WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role...