CVE-2021-24938

The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocsupdateprofilesdata AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected cross-Site Scripting issue...

PT-2021-16376

Name of the Vulnerable Software and Affected Versions: WOOCS WordPress plugin versions prior to 1.3.7.1 Description: The issue arises from the lack of sanitization and escaping of the key parameter in the woocs update profiles data AJAX action, which is accessible to any authenticated user. This...