CVEvulnerability

CVE-2021-25018

5.4 MEDIUM Published 2022-02-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-02-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-862

Description

The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues

Affected configurations

• najeebmedia ppom for woocommerce (< 24.0)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References