| Package | Affected versions | Patched versions |
|---|---|---|
| woocommerce customers manager | < 30.2 | 30.2 |
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free