nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-1747 CVE-2024-1747
MEDIUM
WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS
Record summary
CVE-2024-1747 has a selected CVSS score of 6.5 (medium).
Description
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 1, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
WooCommerce Customers ManagerDefault status: unaffected | CVE List | Before 30.2 | affected |
woocommerce_customers_managerBrowse woocommerce / woocommerce_customers_managerDefault status: unknown | CVE List | Before 30.2 | affected |
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/17e45d4d-0ee1-4863-a8a4-df8587f448ec