| |
Vulnerability CVE-2024-1747
Published: 2024-08-01
| Description: |
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values. |
References: |
https://wpscan.com/vulnerability/17e45d4d-0ee1-4863-a8a4-df8587f448ec/
|
|
|
Copyright 2026, cxsecurity.com
|
|
|
