Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: wp-cart-for-digital-products 8.5.6 Clear all filters
TI-2024-05686 CVE-2024-6136 · GHSA-hfgc-xxrj-48m3

WP eStore < 8.5.6 - Settings Reset via CSRF

Priority MEDIUM 58

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00231 Published 2024-08-09 Fixed in 8.5.6 CWE-352
TI-2024-05683 CVE-2024-6133 · GHSA-c4v2-g748-rmrp

WP eStore < 8.5.6 - Reflected XSS in Customer Search

Priority MEDIUM 62

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0045 Published 2024-08-09 Fixed in 8.5.6 CWE-79