StoreGrowth

StoreGrowth through 2.1.0 registers create_popup for both authenticated and unauthenticated admin-ajax requests. create_popup() checks only the ajd_protected nonce, while front_scripts() publishes that nonce to every front-end visitor as bogo_save_url.ajd_nonce. An unauthenticated attacker can submit attacker-controlled JSON in data; popup_data reaches update_option('spsg_popup_products', ...), overwriting the saved sales-popup configuration. StoreGrowth 2.1.1 removes the unauthenticated hook and requires an admin nonce plus manage_options.

StoreGrowth through 2.1.0 registers the create_popup AJAX action for logged-out visitors. Its only access check uses the ajd_protected nonce, but that same nonce is disclosed to every storefront visitor as bogo_save_url.ajd_nonce. An unauthenticated attacker can submit data[popup_data][message_popup] to create_popup(), which stores the unsanitized value in spsg_popup_products; storefront JavaScript later inserts message_popup with .html(), executing attacker-supplied script for visitors. Version 2.1.1 removes logged-out access, requires manage_options and a separate admin nonce, and sanitizes popup data on save and render.

StoreGrowth through 2.1.0 registers bogo_category_msg_create as both wp_ajax_ and wp_ajax_nopriv_. The handler checks only the public ajd_protected nonce, accepts attacker-controlled data[id], data[message], data[categoryStatus] and optional data[editableId], and writes the result to spsg_bogo_general_settings with update_option(). An unauthenticated attacker can therefore create or modify BOGO category-message configuration. Version 2.1.1 removes the unauthenticated hook and adds an admin nonce and manage_options check.