CVE-2024-6074

CVE-2024-6074 relates to the WordPress plugin wp-cart-for-digital-products (pre-8.5.5). The vulnerability is a Reflected XSS caused by failing to sanitize/escape a parameter before outputting it on the page, potentially exploitable against admin/high-privilege users. Affected versions:

CVE-2024-6136

The CVE-2024-6136 entry concerns wp-cart-for-digital-products for WordPress (pre-8.5.6) lacking CSRF checks in certain areas, potentially enabling a logged-in attacker to cause unintended actions via CSRF. Public advisories from connected sources confirm the issue and note the impact is a CSRF vu...

CVE-2024-6075

The CVE-2024-6075 entry concerns wp-cart-for-digital-products (WP eStore) before 8.5.5, where missing CSRF checks in several areas allow a logged-in user to be coerced into performing unintended actions via CSRF. Affected versions are prior to 8.5.5; VPN-agnostic exploitation is not detailed in t...

CVE-2024-6076

The CVE-2024-6076 vulnerability affects the WordPress plugin WP eStore (wp-cart-for-digital-products) up to version 8.5.5. The issue is a reflected XSS caused by improper sanitisation/escaping of a parameter before it is echoed back on the page, potentially impacting high-privilege users (e.g., a...

CVE-2024-6133

The vulnerability CVE-2024-6133 affects the WordPress plugin wp-cart-for-digital-products (pre-8.5.6). The issue is a Reflected Cross-Site Scripting flaw where a parameter is not sanitized/escaped before output, potentially affecting high-privilege users (e.g., admins). Root cause: inadequate inp...

CVE-2024-6073

CVE-2024-6073 affects the WordPress plugin wp-cart-for-digital-products (WP eStore) up to version 8.5.5. The issue is a reflected XSS where a parameter is not sanitized/escaped before being echoed on a page, enabling exploitation against high-privilege users such as admins. The vulnerability stem...

CVE-2024-6134

CVE-2024-6134 affects wp-cart-for-digital-products (WordPress plugin) prior to version 8.5.6. The vulnerability is a Reflected XSS caused by insufficient sanitization/escaping of a parameter before it is echoed on the page, potentially affecting high-privilege users (admin). The issue is publicly...

CVE-2024-6072

CVE-2024-6072 affects the WordPress plugin wp-cart-for-digital-products up to version 8.5.4, where $_SERVER['REQUEST_URI'] is not escaped when echoed into an attribute, enabling Reflected XSS in older browsers. Remediation: upgrade to version 8.5.5 or later (the fix). Connected Red Hat and Patchs...