WordPress Push Monkey Pro plugin <= 3.9 - CSRF to Stored XSS vulnerability

CVE-2024-54386

What is CVE-2024-54386?

A Cross-Site Request Forgery (CSRF) vulnerability exists in Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart applications developed by Get Push Monkey LLC. This vulnerability allows unauthorized commands to be transmitted from a user that the web application trusts. Specifically, it affects versions from n/a through 3.9, potentially compromising sensitive user actions. Websites utilizing this software should immediately assess their exposure to this security issue to secure their web applications from unauthorized access and malicious actions.

References