CVE-2021-20734

🗓️ 22 Jun 2021 01:35:46Reported by jpcertType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 77 Views🌐 WEB

Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress 跨站脚本漏洞	11 Jun 202100:00	–	cnnvd
Cvelist	CVE-2021-20734	22 Jun 202101:35	–	cvelist
EUVD	EUVD-2021-8148	3 Oct 202520:07	–	euvd
Japan Vulnerability Notes	JVN#70566757: WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting	11 Jun 202100:00	–	jvn
Japan Vulnerability Notes	WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting	11 Jun 202106:24	–	jvn
NVD	CVE-2021-20734	22 Jun 202102:15	–	nvd
Patchstack	WordPress Welcart e-Commerce plugin <= 2.2.3 - Cross-Site Scripting (XSS) vulnerability	11 Jun 202100:00	–	patchstack
Prion	Cross site scripting	22 Jun 202102:15	–	prion
RedhatCVE	CVE-2021-20734	22 May 202519:08	–	redhatcve
wpexploit	Welcart e-Commerce < 2.2.4 - Cross-Site Scripting (XSS)	11 Jun 202100:00	–	wpexploit

NVD

Vulners

Node

welcart welcart_e-commerceMatch1.5.2wordpress

[
  {
    "product": "Welcart e-Commerce",
    "vendor": "Collne Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "versions prior to 2.2.4"
      }
    ]
  }
]

Source	Link
jvn	www.jvn.jp/en/jp/JVN70566757/index.html
welcart	www.welcart.com/archives/14039.html

Parameter	Position	Path	Description	CWE
order_id	query param	/wordpress/wp-admin/admin.php?page=usces_orderlist&order_action=edit&order_id=1\"><script>alert(/XSS/)</script>	Reflected XSS via unsanitized order_id parameter on admin order edit page.	CWE-79

20 Feb 2025 18:32Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.00907

CWE-79