CVE-2024-12280: Cross-Site Request Forgery (CSRF)

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack...

PT-2025-1846 · WordPress · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area versions 8.2.4 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. Recommendations: WP Custom...

CVE-2024-12436: Cross-Site Request Forgery (CSRF)

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Cross site scripting

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-0665 WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-0665

Summary: CVE-2024-0665 affects the WP Customer Area WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting (XSS) via the tab parameter in versions up to and including 8.2.1, caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to in...

WordPress Plugin WP Customer Area Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress WP Customer Area Plugin <= 8.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Customer Area Type Plugin Vulnerable versions = 8.2.2 Fixed in 8.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0665 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f88bc5bdc8b9 Credits Krzysztof Zając...

CVE-2024-0665: Improper Neutralization of Input During Web Page Generation

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-6824

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6824

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6741

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address...

CVE-2023-6824 WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6824

CVE-2023-6824 affects the WordPress plugin WP Customer Area prior to version 8.2.1. The issue is that the plugin does not properly validate user capabilities in some AJAX actions , allowing any user to retrieve another user’s account address. The CVE is consistently described across sources as a ...

CVE-2023-6741 WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address...

CVE-2023-6741

The CVE-2023-6741 entry concerns the WordPress plugin WP Customer Area prior to version 8.2.1. Affected component: plugin AJAX actions where user capabilities are not properly validated, enabling malicious users to edit other users’ account addresses. Public details in connected sources include a...

PT-2024-15100 · Unknown · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area versions prior to 8.2.1 Description: The issue arises from improper validation of user capabilities in certain AJAX actions, allowing any user to retrieve another user's account address. Recommendations: For versions prior to...

CVE-2023-6824: Authorization Bypass Through User-Controlled Key

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

WordPress plugin WP Customer Area security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin WP Customer Area security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...