Woo Thank You Page Customizer Vulnerabilities

[en] Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.8.

Affected:

up to 1.1.8

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-66528 on NVD →

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perfor...

CVSS:

4.3

Affected:

up to 1.1.8

Fixed in:

1.1.9

Disclosed:

Dec 5, 2025

CVE-2025-66528 on NVD →

[en] Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thank You Page Customizer for WooCommerce – Increase Your Sales: from n/a through 1.1.7.

Affected:

up to 1.1.7

Fix:

No patched version reported

Disclosed:

Aug 14, 2025

CVE-2025-30993 on NVD →

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perfor...

CVSS:

4.3

Affected:

up to 1.1.7

Fixed in:

1.1.8

Disclosed:

Aug 11, 2025

CVE-2025-30993 on NVD →

[en] The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the get_text_editor_content() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers,...

Affected:

up to 1.1.3

Fixed in:

1.1.3

Disclosed:

Feb 27, 2024

CVE-2024-1687 on NVD →

[en] The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level ac...

Affected:

up to 1.1.3

Fixed in:

1.1.3

Disclosed:

Feb 27, 2024

CVE-2024-1686 on NVD →

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the get_text_editor_content() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with...

CVSS:

5.4

Affected:

up to 1.1.2

Fixed in:

1.1.3

Disclosed:

Feb 26, 2024

CVE-2024-1687 on NVD →

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access...

CVSS:

4.3

Affected:

up to 1.1.2

Fixed in:

1.1.3

Disclosed:

Feb 26, 2024

CVE-2024-1686 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.

Affected:

up to 1.0.14

Fixed in:

1.0.14

Disclosed:

May 25, 2023

CVE-2022-46812 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.

Affected:

up to 1.0.14

Fixed in:

1.0.14

Disclosed:

May 25, 2023

CVE-2022-46810 on NVD →

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.13. This is due to missing or incorrect nonce validation on the send_email function. This makes it possible for unauthenticated attackers to send ema...

CVSS:

4.3

Affected:

up to 1.0.13

Fixed in:

1.0.14

Disclosed:

Mar 22, 2023

CVE-2022-46812 on NVD →