All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 5.2.3 - Cross-Site Request Forgery

The All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.2.3. This is due to missing or incorrect nonce validation on multiple functions like tvc_call_add_customer_feedback. This makes it possible for unauthenticated attackers to make a user with higher privileges perform unintended actions such as adding customer feedback, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.