CVE-2024-5324

The Login/Signup Popup (Inline Form + Woocommerce) WordPress plugin is vulnerable to unauthorized data modification in versions 2.7.1 through 2.7.2 . The root cause is a missing capability check on the import_settings function, which allows authenticated attackers with Subscriber-level access and...

CVE-2024-8724

CVE-2024-8724 affects the WordPress Waitlist Woocommerce (Back in stock notifier) plugin. A reflected XSS exists in all versions up to 2.7.5 due to improper escaping when constructing URLs with add_query_arg, enabling unauthenticated attackers to inject scripts if a user clicks a manipulated link...