Read the docs
TI-2024-01625 Aliases CVE-2024-1747GHSA-vqgx-gpv3-58p3

WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS

Priority MEDIUM 62CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed WooCommerce Customers Manager (Unknown): 30.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWooCommerce Customers Managerbefore 30.230.2Patch availableCNA
  • WooCommerce Customers Manager VendorUnknown Affected before 30.2 Fixed in 30.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:*before 30.2Vulnerablevanquish
  • cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:* Versions before 30.2 Vulnerable ·vanquish

Remediation

  • Fix · CNA WooCommerce Customers Manager (Unknown) Fixed in 30.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1747
  2. 2026-10-03 Alias added: GHSA-vqgx-gpv3-58p3

References

Exploit 1

  • TI-2024-00361 WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.1
  • TI-2024-03715 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF CVSS 3.1HIGH 8.1
  • TI-2024-02653 WooCommerce Customers Manager < 30.1 - User Deletion via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2024-01621 WooCommerce Customers Manager < 29.8 - Reflected XSS CVSS 3.1MEDIUM 5.9
  • TI-2024-12386 WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2024-01634 WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences