PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS

CVE-2021-25018

What is CVE-2021-25018?

The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues

References