Read the docs

TheCartPress

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

TheCartPress records in CISA KEV

No TheCartPress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Thecartpress Ecommerce Shopping Cart 4 records MEDIUM Boot Store 2 records LOW Thecartpress 1 record LOW

Records

8 records

TI-2021-22545 CVE-2021-47932 · GHSA-r2pw-m85m-3mfq

WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated

Priority HIGH 81

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00403 Published 2026-05-10 No fix listed CWE-862
TI-2015-02922 CVE-2015-3302 · GHSA-r4j5-63wj-7p3r

The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce…

Priority MEDIUM 53

The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.22232 Published 2017-12-29 No fix listed CWE-284
TI-2015-03836 CVE-2015-4582 · GHSA-9cjw-338f-2m2w

Cross-site scripting in TheCartPress boot-store

Priority LOW 31

The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00272 Published 2025-04-28 No fix listed CWE-79
TI-2015-02921 CVE-2015-3301 · GHSA-cpqp-qv9c-w5hq

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The…

Priority LOW 30

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.09101 Published 2015-05-14 No fix listed CWE-22
TI-2015-02920 CVE-2015-3300 · GHSA-rrfq-3wrx-cpcp

Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce…

Priority LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbit…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06376 Published 2015-05-14 No fix listed CWE-79
TI-2024-05503 CVE-2024-5938 · GHSA-2frf-jr2g-pjp7

Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

Priority LOW 28

The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00305 Published 2024-07-02 No fix listed CWE-79
TI-2011-04484 CVE-2011-5207 · GHSA-4gp3-xg6h-2whj

Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the…

Priority LOW 27

Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcp_na…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04535 Published 2012-10-04 No fix listed CWE-79
Open these records in search →