Vulnerabilities

TI-2024-12821 CVE-2024-13795 · GHSA-8x8g-w2mf-7q3v

Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message

LOW 19

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00183 Published 2025-02-18 No fix listed CWE-352

TI-2023-28185 CVE-2023-51533 · GHSA-jfh3-wq2r-73gg

WordPress Ecwid Shopping Cart Plugin <= 6.12.4 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 26

Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00183 Published 2024-02-28 No fix listed CWE-352

TI-2023-05775 CVE-2023-6292 · GHSA-wmg5-vm74-qqx4

Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRF

MEDIUM 53

The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00217 Published 2024-01-16 Fixed in 6.12.5 CWE-352

TI-2023-10030 CVE-2023-24408 · GHSA-9w8q-wmx2-9qw7

WordPress Ecwid Shopping Cart Plugin <= 6.11.4 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.4 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00387 Published 2023-05-08 No fix listed CWE-79

TI-2023-09999 CVE-2023-24377 · GHSA-xh2r-vr89-qm22

WordPress Ecwid Shopping Cart Plugin <= 6.11.3 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-02-14 No fix listed CWE-352

TI-2022-02246 CVE-2022-2432 · GHSA-jg47-cg7m-qw8h

Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update

MEDIUM 41

The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00595 Published 2022-09-06 No fix listed CWE-352