WordPress WooCommerce Customers Manager plugin < 30.2 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WooCommerce Customers Manager versions 30.2...

CVE-2024-2843

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks...

CVE-2024-2843

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks...

CVE-2024-3983

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-1747

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

CVE-2024-1747

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

CVE-2024-3983

The WooCommerce Customers Manager WordPress plugin versions prior to 30.1 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is a failure to perform CSRF checks during certain bulk actions , which could allow an attacker to trick a logged-in administrator into performing u...

CVE-2024-3983 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-3983 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-2843 WooCommerce Customers Manager < 30.1 - User Deletion via CSRF

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks...

CVE-2024-2843 WooCommerce Customers Manager < 30.1 - User Deletion via CSRF

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks...

CVE-2024-1747 WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

CVE-2024-1747

The WooCommerce Customers Manager WordPress plugin (versions prior to 30.2 ) is vulnerable to a lack of authorization and CSRF protection in various AJAX actions. This flaw allows any authenticated user, such as a subscriber, to create, update, or delete customer metadata. Because the plugin fail...

PT-2024-18272 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 30.2 Description: The issue concerns a lack of authorization and CSRF protection in various AJAX actions within the plugin, allowing any authenticated user to update, delete, or...

PT-2024-28687 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 30.1 Description: The issue concerns a lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-22430 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 30.1 Description: The issue concerns a lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in admin users delete users via CSRF attack...

WordPress plugin WooCommerce Customers Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WooCommerce Customers Manager Plugin < 30.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 30.1 Fixed in 30.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2843 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5b5817f75d9e Credits Bob Matyas...

WordPress WooCommerce Customers Manager Plugin < 30.2 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 30.2 Fixed in 30.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1747 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e74aefc31812 Credits Erwan LR...

WordPress plugin WooCommerce Customers Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...