advanced-customized-prompts WordPress plugin vulnerabilities

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order. This allows any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output. This allows any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.