CVE-2023-6824

CVE-2023-6824 affects the WordPress plugin WP Customer Area prior to version 8.2.1. The issue is that the plugin does not properly validate user capabilities in some AJAX actions , allowing any user to retrieve another user’s account address. The CVE is consistently described across sources as a ...

CVE-2024-12436

The WP Customer Area WordPress plugin (versions 8.2.4 and earlier ) is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of proper CSRF checks in certain areas. This flaw could allow an attacker to trick a logged-in user into performing unwanted actions, such as a bulk delete operatio...

CVE-2024-12280

The WP Customer Area WordPress plugin (versions 8.2.4 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a missing CSRF check during the log deletion process. An attacker could leverage this to force a logged-in user to delete logs without their knowledge...

CVE-2024-0665

Summary: CVE-2024-0665 affects the WP Customer Area WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting (XSS) via the tab parameter in versions up to and including 8.2.1, caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to in...

CVE-2017-18519

CVE-2017-18519 affects the WordPress plugin customer-area prior to version 7.4.3, with XSS via admin pages. Root cause: improper sanitization in admin interfaces. Impact: XSS could be triggered from the admin area; remediation: upgrade to 7.4.3 or later.

CVE-2023-6741

The CVE-2023-6741 entry concerns the WordPress plugin WP Customer Area prior to version 8.2.1. Affected component: plugin AJAX actions where user capabilities are not properly validated, enabling malicious users to edit other users’ account addresses. Public details in connected sources include a...