CVE-2024-1747: WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1747?
CVE-2024-1747 is classified as a high severity vulnerability due to the potential for unauthorized access and manipulation of customer metadata.
How do I fix CVE-2024-1747?
To fix CVE-2024-1747, update the WooCommerce Customers Manager plugin to version 30.2 or higher.
Who is affected by CVE-2024-1747?
CVE-2024-1747 affects all versions of the WooCommerce Customers Manager plugin prior to 30.2.
What type of vulnerability is CVE-2024-1747?
CVE-2024-1747 is a security vulnerability that involves authorization issues and the potential for stored cross-site scripting.
What can an attacker do with CVE-2024-1747?
An attacker exploiting CVE-2024-1747 can manipulate customer metadata and potentially execute malicious JavaScript on affected sites.