4.3
Medium
CVE-2024-10437 The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message…
Description
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPC Smart Messages for WooCommerce 4.2 | earliest → 4.2.1 | No fix stated |
Other CVEs of WPC Smart Messages for WooCommerce
The 4 CVEs of WPC Smart Messages for WooCommerce →
CVE-2026-6725
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
6.4
Medium
CVE-2025-62903
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Smart…
6.5
Medium
CVE-2024-10436
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,…
8.8
High