Marvinlabs maintains a narrow portfolio of WordPress plugins, principally Customer Area and User Messages, that extend membership and messaging functionality to site administrators. The vendor's disclosed vulnerabilities center on web-application input-handling and authorization flaws—notably cross-site scripting, cross-site request forgery, and user-controlled authorization bypass—which are characteristic of plugin-level extensions to WordPress that interact directly with user input and session state. Public exploit code has frequently been made available for vulnerabilities in this vendor's products; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Marvinlabs over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-13222MEDIUM The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which c | Jan 31, 2025 | 6.1 | 28 | NO | YES |
CVE-2023-6824MEDIUM The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account ad | Jan 16, 2024 | 6.5 | 20 | NO | NO |
CVE-2017-18519MEDIUM The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. | Aug 20, 2019 | 6.1 | 20 | NO | NO |
CVE-2024-0665MEDIUM The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient in | Jan 24, 2024 | 6.1 | 18 | NO | NO |
CVE-2023-6741MEDIUM The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account | Jan 16, 2024 | 4.3 | 16 | NO | NO |
CVE-2024-12436MEDIUM The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF | Jan 27, 2025 | 4.3 | 15 | NO | NO |
CVE-2024-12280MEDIUM The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a C | Jan 27, 2025 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Marvinlabs.
Media articles that mention a CVE ID that affects a product developed by Marvinlabs — matched by CVE ID, not by vendor name.