Wp Customer Area
Approved changes feed: RSS · Atom
cpe:2.3:a:marvinlabs:wp_customer_area:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Marvinlabs (f4ca5bee-5c6c-553e-b102-0aba4a7a7145) |
|---|---|
| Product | Wp Customer Area (d4052ea7-0549-5f6b-adc8-e5ea989e749a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-12436 |
vulnerable | 2026-06-08 06:23:51.943539 |
WP Customer Area <= 8.2.4 - Bulk Delete via CSRF
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Published: 2025-01-27T06:00:06.330Z
Updated: 2025-01-27T20:06:08.471Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12280 |
vulnerable | 2026-06-08 06:23:51.600466 |
WP Customer Area <= 8.2.4 - Event Log Deletion via CSRF
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack
Published: 2025-01-27T06:00:04.043Z
Updated: 2025-01-28T20:35:59.181Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0665 |
vulnerable | 2026-06-08 06:22:01.675267 |
WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting
MEDIUM (6.1)
The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2024-01-24T07:30:17.138Z
Updated: 2026-04-08T16:53:41.099Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6824 |
vulnerable | 2026-06-08 06:21:55.950422 |
WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
Published: 2024-01-16T15:57:00.656Z
Updated: 2025-06-11T16:39:31.579Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6741 |
vulnerable | 2026-06-08 06:21:55.612086 |
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
Published: 2024-01-16T15:56:59.595Z
Updated: 2025-06-20T17:22:43.549Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-18519 |
vulnerable | 2026-06-08 05:09:11.200067 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.