2 matches found
CVE-2021-25018
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS i...
CVE-2019-14948
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.