E-commerce Security Vulnerabilities and Issues — E-commerce CVE List

Lucene search

WelcartE-commerce

3 matches found

CVE•added 2023/12/04 10:15 p.m.•40 views

CVE-2023-5952

The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog

9.8CVSS9.7AI score0.00688EPSS

CVE•added 2023/12/04 10:15 p.m.•32 views

CVE-2023-5953

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server

8.8CVSS8.8AI score0.00567EPSS

CVE•added 2023/12/04 10:15 p.m.•28 views

CVE-2023-5951

The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

6.1CVSS6AI score0.00284EPSS