CVE-2026-0552 Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode

The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpscdisplayproduct' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-0552

CVE-2026-0552 affects the WordPress plugin Simple Shopping Cart (versions up to and including 5.2.4). The issue is a Stored Cross-Site Scripting vulnerability via the plugin’s 'wpsc_display_product' shortcode , caused by insufficient input sanitization and output escaping on user-supplied attribu...

CVE-2025-14846

The SocialChamp with WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5. This is due to missing nonce validation on the wpscsettingstabmenu function. This makes it possible for unauthenticated attackers to modify plugin settings...

WordPress plugin SocialChamp with WordPress 跨站请求伪造漏洞

WordPress SocialChamp with WordPress plugin is a plugin called SocialChamp which focuses on social media automation management. WordPress SocialChamp with WordPress plugin suffers from a cross-site request forgery vulnerability that stems from a lack of random number validation in the...

CVE-2021-24843

The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsctickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the setdeletepermanentlybulkticket settingaction...

CVE-2021-24839

The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsctickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the setdeletepermanentlybulkticket settingaction. Other actions may be affected as well...

PT-2022-9480 · WordPress · Supportcandy

Name of the Vulnerable Software and Affected Versions: SupportCandy WordPress plugin versions prior to 2.2.5 Description: The issue is related to the lack of authorisation and CSRF checks in the wpsc tickets AJAX action, which could allow unauthenticated users to delete arbitrary tickets via the...

Wordpress Plugin SupportCandy 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in...

WPsc MijnPress - 'rwflush' Parameter Cross Site Scripting

The WPsc MijnPress WordPress plugin was affected by a 'rwflush' Parameter Cross Site Scripting security vulnerability...

Wordpress WPsc-MijnPress plugin Cross-Site Scripting Vulnerabilities

a bug in Wordpress WPsc-MijnPress plugin that allows to us to occur a Cross-Site Scripting on a Remote machin. Exploit Title : Wordpress WPsc-MijnPress plugin Cross-Site Scripting Vulnerabilities Author : BHG Security Center - IrIsT Security Team Discovered By : Am!r Home : http://Black-hg.Org -...

WordPress WPsc MijnPress Plugin - Cross Site Scripting

WordPress WPsc MijnPress plugin's "rwflush'" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can ste...

WordPress Plugin WPsc MijnPress - 'rwflush' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53302/info The WPsc MijnPress for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

WordPress WPsc-MijnPress Cross Site Scripting

Exploit Title : Wordpress WPsc-MijnPress plugin Cross-Site Scripting Vulnerabilities Author : BHG Security Center - IrIsT Security Team Discovered By : Am!r Home : http://Black-hg.Org - http://IrIsT.Ir Software Link : http://wordpress.org/extend/plugins/wpsc-mijnpress/ Security Risk : High Versio...

WordPress Plugin WPsc MijnPress - rwflush Cross-Site Scripting

WordPress Plugin WPsc MijnPress - rwflush Cross-Site Scripting source: https://www.securityfocus.com/bid/53302/info The WPsc MijnPress for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to...