Cross-site scripting (XSS) in s-cart/s-cart
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
Why it matters now
EPSS 0.00609 49th percentileScored 2026-11-07
Fix Fixed s-cart/s-cart: 6.9s-cart/core: 6.9+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | s-cart/s-cart | before 6.9 | 6.9 | Patch available | CNA |
| — | s-cart/core | before 6.9 | 6.9 | Patch available | CNA |
| — | s-cart/core (Packagist) | before 6.9 | 6.9 | Patch available | GHSA-7pfc-cx3m-v22x |
| — | s-cart/s-cart (Packagist) | before 6.9 | 6.9 | Patch available | GHSA-7pfc-cx3m-v22x |
- s-cart/s-cart Vendor— Affected before 6.9 Fixed in 6.9 Patch available CNA
- s-cart/core Vendor— Affected before 6.9 Fixed in 6.9 Patch available CNA
- s-cart/core (Packagist) Vendor— Affected before 6.9 Fixed in 6.9 Patch available GHSA-7pfc-cx3m-v22x
- s-cart/s-cart (Packagist) Vendor— Affected before 6.9 Fixed in 6.9 Patch available GHSA-7pfc-cx3m-v22x
Remediation
- Fix · CNA s-cart/s-cart Fixed in 6.9
- Fix · CNA s-cart/core Fixed in 6.9
- Fix · GHSA-7pfc-cx3m-v22x s-cart/core (Packagist) Fixed in 6.9 Advisory →
- Fix · GHSA-7pfc-cx3m-v22x s-cart/s-cart (Packagist) Fixed in 6.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21149
- 2026-10-03 Alias added: GHSA-7pfc-cx3m-v22x
References
More S-cart vulnerabilities
- TI-2021-16325 S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability… CVSS 3.1HIGH 8.8
- TI-2020-17271 Cross-site scripting (XSS) in s-cart/core CVSS 3.1HIGH 7.3
- TI-2020-17272 Cross-site scripting (XSS) in s-cart/core CVSS 3.1HIGH 7.2
- TI-2021-19827 A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup. CVSS 3.1MEDIUM 4.4
Sources
- CVE-2022-21149 · CVE Program
- CVE-2022-21149 · NVD
- FIRST EPSS
- GHSA-7pfc-cx3m-v22x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences