The advanced-customized-prompts WordPress plugin through 1.0.1 has a vulnerability allowing any authenticated user, such as a subscriber, to tamper with custom metadata of orders belonging to other customers due to a lack of capability, ownership, or nonce checks before updating WooCommerce order item metadata. This issue can lead to potential data integrity problems and unauthorized modifications. Defend [truncated]
MEDIUMadvanced-customized-promptsCVE published 2026-09-11
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
CRITICALadvanced-customized-promptsCVE published 2026-09-11
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts. This vulnerability enables attackers to bypass authentication mechanisms, potentially [truncated]
