The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the get_text_editor_content() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
References
Configurations
Configuration 1 (hide)
|
History
15 Jan 2025, 19:53
Type | Values Removed | Values Added |
---|---|---|
References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3041096%40woo-thank-you-page-customizer&new=3041096%40woo-thank-you-page-customizer&sfp_email=&sfph_mail= - Patch | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/310afe02-3a51-4633-b359-65ae58d0c032?source=cve - Third Party Advisory | |
First Time |
Villatheme
Villatheme woocommerce Thank You Page Customizer |
|
CPE | cpe:2.3:a:villatheme:woocommerce_thank_you_page_customizer:*:*:*:*:free:wordpress:*:* | |
CWE | CWE-862 |
21 Nov 2024, 08:51
Type | Values Removed | Values Added |
---|---|---|
References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3041096%40woo-thank-you-page-customizer&new=3041096%40woo-thank-you-page-customizer&sfp_email=&sfph_mail= - | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/310afe02-3a51-4633-b359-65ae58d0c032?source=cve - |
27 Feb 2024, 14:20
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
27 Feb 2024, 06:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-02-27 06:15
Updated : 2025-01-15 19:53
NVD link : CVE-2024-1687
Mitre link : CVE-2024-1687
CVE.ORG link : CVE-2024-1687
JSON object : View
Products Affected
villatheme
- woocommerce_thank_you_page_customizer
CWE
CWE-862
Missing Authorization