The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Woocommerce Customers Manager Plugin | — | Update woocommerce-customers-manager plugin to version 30.2, or a newer patched version | May 15, 2025 | Jul 11, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub