CVE-2023-5953

The CVE-2023-5953 issue affects the Welcart e-Commerce WordPress plugin prior to 2.9.5. The vulnerability arises from lack of file validation and missing authorization/CSRF protections in an AJAX upload action, enabling any authenticated user (e.g., subscribers) to upload arbitrary files such as ...

CVE-2023-5952

The CVE-2023-5952 entry concerns the Welcart e-Commerce WordPress plugin prior to version 2.9.5. Affected component/process: the plugin unserializes user input from cookies, enabling PHP Object Injection when a suitable gadget is present on the blog. Root cause: untrusted cookie deserialization i...

CVE-2023-5952 Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection

The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog...

CVE-2023-5953: Unrestricted Upload of File with Dangerous Type

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server...

CVE-2023-5952: Undefined Security Weakness

The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog...

PT-2023-32441 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.9.5 Description: The issue arises from the lack of file validation for uploads and the absence of authorization and CSRF protection in an AJAX action handling file uploads. This allows a...

WordPress plugin Welcart e-Commerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-5951: Improper Neutralization of Input During Web Page Generation

The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress plugin Welcart e-Commerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-32440 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.9.5 Description: The issue allows unauthorized users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the plugin unserializing user input from cookie...

CVE-2023-4406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

CVE-2023-4406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2023-4406 XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

CVE-2023-4406

CVE-2023-4406 is a Reflected XSS vulnerability in KC Group E-Commerce Software affecting versions through 20231123. The root cause is improper neutralization of input during web page generation. Multiple sources (NVD, Red Hat, CNNVD, PRION, CVELIST, VulnEnrichment) corroborate that the issue exis...

CVE-2023-4406 XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

PT-2023-29084 · Unknown · Kc Group E-Commerce

Name of the Vulnerable Software and Affected Versions: KC Group E-Commerce Software versions through 20231123 Description: The issue affects the KC Group E-Commerce Software, allowing for Reflected XSS due to improper neutralization of input during web page generation. The vendor was contacted...

SAHU TikTok Pixel for E-Commerce <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The SAHU TikTok Pixel for E-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-4406: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

Fortify Your Online Business – Security Tips for Starting an e-Commerce Website

By Owais Sultan E-commerce is a lucrative business, but it requires hard work and robust cybersecurity. This is a post from HackRead.com Read the original post: Fortify Your Online Business - Security Tips for Starting an e-Commerce Website...