CVE-2024-12204

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
premio	Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce	<= 1.3.5

References

Timeline

Published: Jan 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-122055.4The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all vers CVE-2024-122064.3The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl CVE-2024-122074.4The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versio CVE-2024-122099.8The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and in CVE-2024-12213.1This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacte CVE-2024-122104.3The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing CVE-2024-122115.4Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.CVE-2024-122127.8The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which cou CVE-2024-122139.8The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allo CVE-2024-122146.1The WooCommerce HSS Extension for Streaming Video plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘videolink’ p CVE-2024-122158.8In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. CVE-2024-122167.1A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary f