WordPress Themebox - Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

WordPress Themebox - Digital Products Ecommerce theme = 1.4.2 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Themebox - Digital Products Ecommerce versions = 1.4.2...

mall 安全漏洞

mall is an e-commerce system for macro individual developers, including the front-end mall system and the back-end management system. A security vulnerability exists in mall 1.0.3 and earlier versions, which stems from an issue with the transmission of sensitive information in clear text...

WordPress plugin Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-8198

CVE-2025-8198 - MinimogWP (WordPress Theme) Affected: MinimogWP – The High Converting eCommerce WordPress Theme, versions up to 3.9.0.Root cause: Insufficient validation of cart quantity inputs when adjusting item quantities, enabling price manipulation.Impact: Unauthenticated attackers can add i...

CVE-2025-8198: External Control of Assumed-Immutable Web Parameter

The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9.0. This is due to an insufficient check on quantity values when changing quantities in the cart. This makes it possible for unauthenticat...

E-Commerce Site Cross-Site Request Forgery Vulnerability

E-Commerce Site is an e-commerce site. E-Commerce Site suffers from a cross-site request forgery vulnerability that stems from the WEB application not adequately verifying that a request is coming from a trusted user. No details of the vulnerability are available at this time...

CVE-2025-7756

A vulnerability classified as problematic has been found in code-projects E-Commerce Site 1.0. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used...

Code-Projects E-Commerce Site 安全漏洞

E-Commerce Site is an e-commerce site. E-Commerce Site suffers from a cross-site request forgery vulnerability that stems from the WEB application not adequately verifying that a request is coming from a trusted user. No details of the vulnerability are available at this time...

Malware in @ecommerce-cart-ui/client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5867 Malicious code in @ecommerce-cart-ui/client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bac1b682b09340a43e74619f9ac55f2be98bfb14eb37a21597fb9f81b46f4161 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via multiple pages when handling the lang or systemtype arguments. An attacker can inject and execute arbitrary scripts in the context of a user's browser by supplying...

Code-Projects E-Commerce Site 代码问题漏洞

E-Commerce Site is an e-commerce site. E-Commerce Site suffers from an arbitrary file upload vulnerability that stems from improper manipulation of the parameter photo in the file /admin/usersphoto.php, no details of the vulnerability are available at this time...

CVE-2025-52807 WordPress Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme kossy allows PHP Local File Inclusion.This issue affects Kossy - Minimalist eCommerce WordPress Theme: from n/a through = 1.45...

CVE-2025-52807: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme kossy allows PHP Local File Inclusion.This issue affects Kossy - Minimalist eCommerce WordPress Theme: from n/a through = 1.45...

WordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by mcdruid in WordPress Plugin eCommerce Product Catalog versions = 3.4.3...

CVE-2025-49331

Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through = 3.4.3...

CVE-2025-49331

Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through = 3.4.3...

CVE-2025-49331

CVE-2025-49331 affects the WordPress plugin eCommerce Product Catalog (versions

CVE-2025-49331 WordPress eCommerce Product Catalog <= 3.4.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog allows Object Injection. This issue affects eCommerce Product Catalog: from n/a through 3.4.3...

CVE-2025-49331 WordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through = 3.4.3...