CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-13343 – WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-13343
31 Jan 2025 — The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_assign_new_roles() function in all versions up to, and including, 31.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. • https://codecanyon.net/item/woocommerce-customers-manager/10965432 • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1747 – WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-1747
11 Jul 2024 — The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values. El complemento de WordPress WooCommerce Customers Manager anterior a 30.2 no tiene autorización ni CSRF en varias acciones AJAX, lo que permite a cualquier usuario autenticado, co... • https://wpscan.com/vulnerability/17e45d4d-0ee1-4863-a8a4-df8587f448ec • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-2843 – WooCommerce Customers Manager < 30.1 - User Deletion via CSRF
https://notcve.org/view.php?id=CVE-2024-2843
11 Jul 2024 — The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks El complemento de WordPress WooCommerce Customers Manager anterior a 30.1 no tiene comprobaciones CSRF en algunos lugares, lo que podría permitir a los atacantes hacer que los usuarios administradores registrados eliminen usuarios mediante ataques CSRF. The WooCommerce Customers Manager plugin for WordPress is vulnera... • https://wpscan.com/vulnerability/fec4e077-4c4e-4618-bfe8-61fdba59b696 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3983 – WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF
https://notcve.org/view.php?id=CVE-2024-3983
11 Jul 2024 — The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks El complemento de WordPress WooCommerce Customers Manager anterior a la versión 30.1 no tiene comprobaciones CSRF en algunas acciones masivas, lo que podría permitir a los atacantes hacer que los administradores que han iniciado sesión realicen acciones no deseadas, como elimin... • https://wpscan.com/vulnerability/e4059d66-07b9-4f1a-a461-d6e8f0e98eec • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1743 – WooCommerce Customers Manager < 29.8 - Reflected XSS
https://notcve.org/view.php?id=CVE-2024-1743
03 Apr 2024 — The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El complemento de WordPress WooCommerce Customers Manager anterior a la versión 29.8 no sanitiza ni escapa de varios parámetros antes de devolverlos a páginas y atributos, lo que genera Cross-Site Scripting Reflejado que podría usarse contra... • https://wpscan.com/vulnerability/3cb1f707-6093-42a7-a778-2b296bdf1735 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1756 – WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure
https://notcve.org/view.php?id=CVE-2024-1756
02 Apr 2024 — The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name El complemento WooCommerce Customers Manager de WordPress anterior a 29.8 no tiene autorización ni CSRF en una acción AJAX, lo que permite a cualquier usuario autenticado, como un suscriptor, llamarlo y recuperar la lista de direcci... • https://wpscan.com/vulnerability/0baedd8d-2bbe-4091-bec4-f99e25d7290d • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.9EPSS: 4%CPEs: 1EXPL: 2CVE-2024-0399 – WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection
https://notcve.org/view.php?id=CVE-2024-0399
25 Mar 2024 — The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role. El complemento WooCommerce Customers Manager de WordPress anterior a la versión 29.7 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección de SQL explotable por el rol Suscriptor+. The WooCommerce Customers Manager plugin for WordPress is ... • https://github.com/xbz0n/CVE-2024-0399 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •