Lucene search

Le Ngoc AnhPATCHSTACK:B5167021DA9A7887874C3FE238224881

HistoryJan 27, 2023 - 12:00 a.m.

WordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)

2023-01-2700:00:00

Le Ngoc Anh

patchstack.com

wordpress

welcart e-commerce

plugin

cross site scripting

vulnerable version

fixed version

owasp top 10

cve-2023-22705

patch priority

cvss severity

developer

psid

credits

required privilege

published

mitigation advice

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

5.7

Confidence

High

JSON

Software

Welcart e-Commerce

Type

Plugin

Vulnerable versions

<= 2.8.10

Fixed in

2.8.11

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Classification

Cross Site Scripting (XSS)

CVE

CVE-2023-22705

Patch priority

Medium

CVSS severity

Medium (7.1)

Developer

Claim ownership

PSID

009875894ecf

Credits

Le Ngoc Anh

Required privilege

Unauthenticated

Published

27 January, 2023

Expand full details Have additional information or questions about this entry? Let us know.

Solution

We advise to mitigate or resolve the vulnerability immediately.

Affected configurations

Vulners

Node

welcart_inc.welcart_e-commerceRange≤2.8.10

VendorProductVersionCPE
welcart_inc.welcart_e-commerce*cpe:2.3:a:welcart_inc.:welcart_e-commerce:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
welcart_inc.	welcart_e-commerce	*	cpe:2.3:a:welcart_inc.:welcart_e-commerce::::::::

References

wordpress.org/plugins/usc-e-shop/#developers

www.cve.org/CVERecord?id=CVE-2023-22705