Vulnerabilities

Filters

2 selected

10 records

Sort

Vendor: levelfourstorefront Component: Wp Easycart Clear all filters

TI-2023-02831 CVE-2023-3023 · GHSA-6c66-vmmw-cg64

WP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'

LOW 35

The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00701 Published 2023-07-12 No fix listed CWE-89

TI-2023-02710 CVE-2023-2892 · GHSA-82gc-4r76-jvvf

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product

LOW 28

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0023 Published 2023-06-09 No fix listed CWE-352

TI-2023-02712 CVE-2023-2894 · GHSA-23m5-7wvw-4c3f

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_deactivate_product

LOW 20

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00241 Published 2023-06-09 No fix listed CWE-352

TI-2023-02711 CVE-2023-2893 · GHSA-w56x-97x4-6w54

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_deactivate_product

LOW 20

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00241 Published 2023-06-09 No fix listed CWE-352

TI-2023-02714 CVE-2023-2896 · GHSA-5jgx-r396-pr78

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_duplicate_product

LOW 20

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00241 Published 2023-06-09 No fix listed CWE-352

TI-2023-02713 CVE-2023-2895 · GHSA-m828-jv6m-34hv

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_activate_product

LOW 20

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00241 Published 2023-06-09 No fix listed CWE-352

TI-2023-02709 CVE-2023-2891 · GHSA-c4xm-fwm7-92hc

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product

LOW 28

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00244 Published 2023-06-09 No fix listed CWE-352

TI-2023-01063 CVE-2023-1124 · GHSA-q37p-4rw5-7329

Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

HIGH 67

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01084 Published 2023-04-03 Fixed in 5.4.3 CWE-552

TI-2015-02358 CVE-2015-2673 · GHSA-6x9p-fwgv-g747

The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in…

MEDIUM 56

The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileg…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.18932 Published 2017-10-06 No fix listed CWE-264

TI-2014-07551 CVE-2014-9308 · GHSA-37q4-xqq6-qvgv

Unrestricted file upload vulnerability in…

MEDIUM 60

Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary cod…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.50568 Published 2015-01-15 No fix listed