CVE-2024-12826 GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update

The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woohactionsettingssavefrontend function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to...

CVE-2024-12826 GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update

The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woohactionsettingssavefrontend function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to...

CVE-2024-12826

The CVE-2024-12826 flaw affects the GoHero Store Customizer for WooCommerce (WordPress). It stems from a missing capability check in the wooh_action_settings_save_frontend() function in all versions up to and including 3.5, enabling unauthenticated attackers to modify limited plugin settings. Imp...

WordPress plugin GoHero Store Customizer for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1962 · WordPress · Gohero Store Customizer For Woocommerce

Name of the Vulnerable Software and Affected Versions: GoHero Store Customizer for WooCommerce plugin for WordPress versions up to, and including, 3.5 Description: The issue allows unauthorized modification of data due to a missing capability check on the wooh action settings save frontend...

CVE-2024-12826: Missing Authorization

The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woohactionsettingssavefrontend function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to...

CVE-2025-22802 WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop...

CVE-2025-22802: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag A...

WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail versions = 2.1.4...

CVE-2024-12594: Missing Authorization

The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Temporary admin login access , Rename login , Login customizer, Hide wp-login – Limit Login Attempts – Locked Site plugin for WordPress is vulnerable to privilege escalation due to a...

CVE-2024-11457: Improper Neutralization of Input During Web Page Generation

The Feedpress Generator – External RSS Frontend Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2024-9371: Improper Neutralization of Input During Web Page Generation

The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.4.19. This makes it possible for unauthenticated...

CVE-2024-52424

Cross-Site Request Forgery CSRF vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through = 1.0...

CVE-2024-52424

Cross-Site Request Forgery CSRF vulnerability in Suresh Kumar wp-login customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through 1.0...

CVE-2024-52424

CVE-2024-52424 — A CSRF allows Stored XSS in the WordPress plugin wp-login-customizer (versions

WordPress plugin wp-login customizer 请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2024-35264 · Unknown · Suresh Kumar Wp-Login Customizer

Name of the Vulnerable Software and Affected Versions: Suresh Kumar wp-login customizer versions 1.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Suresh Kumar wp-login customizer. Recommendations: For Suresh Kumar wp-login...

CVE-2024-52424: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through = 1.0...

WordPress wp-login customizer plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin wp-login customizer versions = 1.0...

CVE-2024-8959: Improper Neutralization of Input During Web Page Generation

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...