CVE-2024-5324highobserved exploitationCWE-862

CVE-2024-5324: high-severity vulnerability in xootix Login & Register Customizer – Popup |…

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

Published · Updated

Follow this CVE+ Monitor Waitlist Woocommerce+ Monitor OTP Login & Register Woocommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 8.8epss 1.5%
from disclosure to weaponsame day
Published on NVDJun 6
1st PoCJun 6
VulnCheckJun 5
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
xootix · Login & Register Customizer – Popup | Slider | Inline | WooCommercexootix · OTP Login & Register Woocommercexootix · Side Cart Woocommerce | Woocommerce Cartxootix · Waitlist Woocommerce ( Back in stock notifier )
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — xootix Login & Register Customizer – Popup |…

In the same product, most dangerous first.

CVE-2023-2706HIGHOTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege EscalationEPSS 1.7%CVE-2020-36715HIGHLogin/Signup Popup < 1.5 - Missing AuthorizationEPSS 0.7%CVE-2026-12215MEDIUMOTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute ForceEPSS 0.6%CVE-2026-12402MEDIUMOTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' SettingEPSS 0.3%CVE-2025-1064MEDIUMLogin/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action ShortcodeEPSS 0.3%