Five Takeaways from Black Friday & Cyber Monday Cyber Attacks

The online retail industry is one of the prime targets for cybercrime, as detailed in our annual analysis of the cybersecurity threats targeting eCommerce websites and applications. As the 2023 holiday shopping season continues, Imperva Threat Research is closely monitoring how cybercriminals are...

CVE-2023-4406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2023-47839

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin = 3.3.26 versions...

CVE-2023-47839

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin = 3.3.26 versions...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin = 3.3.26 versions...

KC Group E-Commerce Software Cross-Site Scripting Vulnerability

KC Group E-Commerce Software is an e-commerce software from the Turkish company KC Group. A cross-site scripting vulnerability exists in KC Group E-Commerce Software version 20231123 and prior versions, which arises from improper input neutralization during web page generation...

CVE-2023-47839

CVE-2023-47839 affects the WordPress plugin eCommerce Product Catalog (

CVE-2023-47839 WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin = 3.3.26 versions...

PrestaShop Chronopost Official Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts, and product image zoom, among other features. A security vulnerability exists in PrestaShop Chronopost Official. An attacker can exploit...

WordPress Plugin eCommerce Product Catalog Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS)

Software eCommerce Product Catalog Type Plugin Vulnerable versions = 3.3.26 Fixed in 3.3.27 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47839 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6511afa732b3 Credits LVT-tholv2k Required...

WordPress eCommerce Product Catalog Plugin <= 3.3.25 is vulnerable to Cross Site Request Forgery (CSRF)

Software eCommerce Product Catalog Type Plugin Vulnerable versions = 3.3.25 Fixed in 3.3.26 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cae1cf59e97f Credits Unknown Required...

VulnCheck KEV: CVE-2022-41840

Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin = 2.7.7 on WordPress...

eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF

Description The plugin does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products Make a logged in admin open the URL below...

eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF

Description The plugin does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products PoC Make a logged in admin open the URL below...

CVE-2023-46642

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin = 1.2.2 versions...

Online Retailers: Five Threats Targeting Your Business This Holiday Shopping Season

As the holiday season approaches, a palpable sense of joy and anticipation fills the air. Twinkling lights adorn homes, the aroma of freshly baked cookies wafts through the kitchen, and the sound of laughter and carolers melodies resonate on frosty evenings. Its a time when families come together...

EC-CUBE Security Vulnerability

EC-CUBE is an open source e-commerce system from EC-CUBE Japan. A security vulnerability exists in EC-CUBE 3 series 3.0.0 to 3.0.18-p6 and 4 series 4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2 releases, which is caused by an arbitrary code execution vulnerability due to improper...

PrestaShop Kerawen Security Vulnerability

PrestaShop KerAwen is an e-commerce cash register solution from PrestaShop USA. A security vulnerability exists in PrestaShop Kerawen versions prior to v2.5.1 that stems from the parameter ocsidcart containing an SQL injection vulnerability...

Why Bad Bots Are the Digital Demons of the Internet

In the dimly lit corners of the internet, where shadows flicker and eerie silences prevail, there lurks entities of malevolent intent. They are not the stuff of old wives tales or campfire ghost stories. We’re talking about bad bots, the digital bogeymen of the digital age. These nefarious beings...