CVE-2022-23072

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

CVE-2022-23072

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

Cross site scripting

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

CVE-2022-23072

CVE-2022-23072 : In Recipes (versions 1.0.5–1.2.5), a Stored XSS flaw exists in the Add to Cart flow. An attacker can inject a malicious payload via the Name parameter on the food list page, triggering the XSS when adding to the shopping cart. This could enable the attacker to capture the victim’...

CVE-2022-23072 Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

CVE-2022-23072 Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

Malicious code in cart-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2856576c4df628bed193bb9ad1d6223d7ac9f81f4e5592cfe77c531f9bfcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1833 Malicious code in cart-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2856576c4df628bed193bb9ad1d6223d7ac9f81f4e5592cfe77c531f9bfcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @harrysforge/gatsby-theme-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bec2a0c2933475670023407273df67f06a810947c55c2bb58484ff145a09cb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-312 Malicious code in @harrysforge/gatsby-theme-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bec2a0c2933475670023407273df67f06a810947c55c2bb58484ff145a09cb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in woo-cart-expiration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24cfe9d8fcf65de1f13300aad8d4f80a7799b08acca23005f742a7addac882ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7213 Malicious code in woo-cart-expiration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24cfe9d8fcf65de1f13300aad8d4f80a7799b08acca23005f742a7addac882ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ps-cart-recovery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2796fa288d4cdbb8c44fa760bce301d9f11d9f40f3707935733e2582b92244e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5500 Malicious code in ps-cart-recovery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2796fa288d4cdbb8c44fa760bce301d9f11d9f40f3707935733e2582b92244e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sc-add-to-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5257c8252b296dd5d8b693935047369934e120b7e0c18c6497b922fb174455c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5948 Malicious code in sc-add-to-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5257c8252b296dd5d8b693935047369934e120b7e0c18c6497b922fb174455c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cart-bucketing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 865fc5f382d06b6070c00326e9f0edf77b907fd00956efa8da261df46d1e7a89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WooCommerce Menu Cart < 2.12.0 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC When there is no shop active yet: https://example.com/wp-admin/index.php?a"...

WooCommerce Menu Cart < 2.12.0 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting When there is no shop active yet: https://example.com/wp-admin/index.php?a"alert/XSS/...

WordPress WooCommerce Menu Cart plugin <= 2.11.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress WooCommerce Menu Cart plugin versions = 2.11.0. Solution Update the WordPress WooCommerce Menu Cart plugin to the latest available version at least 2.12.0...