Vendors / Ecwid Ecommerce Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Ecwid Ecommerce records in CISA KEV No Ecwid Ecommerce vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 53
The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS 3.1 MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00217 · Published 2024-01-16 · Fixed in 6.12.5 CWE-352
Priority MEDIUM 41
The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00595 · Published 2022-09-06 · No fix listed CWE-352
Priority LOW 38
Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00264 · Published 2023-02-14 · No fix listed CWE-352
Priority LOW 29
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.4 versions.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00387 · Published 2023-05-08 · No fix listed CWE-79
Priority LOW 26
Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00183 · Published 2024-02-28 · No fix listed CWE-352
Priority LOW 19
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27.
CVSS 3.1 MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00183 · Published 2025-02-18 · No fix listed CWE-352
Open these records in search → All records by CVSS severity
0 2 4 0 0
THREATIST.IORead the docs