CVE-2024-3734

The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 1.4.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.

• CWE-94

• https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/woocs.php#L4154
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072307%40woocommerce-currency-switcher%2Ftrunk&old=3049249%40woocommerce-currency-switcher%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1d49d0-c9aa-401c-80b9-d4df7fe97691?source=cve
• https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/woocs.php#L4154
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072307%40woocommerce-currency-switcher%2Ftrunk&old=3049249%40woocommerce-currency-switcher%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1d49d0-c9aa-401c-80b9-d4df7fe97691?source=cve

Published

May 2, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37334Microsoft OLE DB Driver for SQL Server Remote Code Execution…8.8
• CVE-2024-37335Microsoft SQL Server Native Scoring Remote Code Execution Vu…8.8
• CVE-2024-37336SQL Server Native Client OLE DB Provider Remote Code Executi…8.8
• CVE-2024-37337Microsoft SQL Server Native Scoring Information Disclosure V…4.3
• CVE-2024-37338Microsoft SQL Server Native Scoring Remote Code Execution Vu…8.8
• CVE-2024-37339Microsoft SQL Server Native Scoring Remote Code Execution Vu…8.8
• CVE-2024-37340Microsoft SQL Server Native Scoring Remote Code Execution Vu…8.8
• CVE-2024-37341Microsoft SQL Server Elevation of Privilege Vulnerability9.8
• CVE-2024-37342Microsoft SQL Server Native Scoring Information Disclosure V…4.3
• CVE-2024-37343There is a cross-site scripting vulnerability in the Secure …5.4
• CVE-2024-37344There is a cross-site scripting vulnerability in the Policy …3.4
• CVE-2024-37345There is a cross-site scripting vulnerability in the Secure …5.4