Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Welcart e-Commerce 2.9.5 Clear all filters
TI-2023-05482 CVE-2023-5951 · GHSA-q765-37pc-9f2c

Welcart e-Commerce < 2.9.5 - Reflected XSS

Priority MEDIUM 60

The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00471 Published 2023-12-04 Fixed in 2.9.5 CWE-79
TI-2023-05484 CVE-2023-5953 · GHSA-5w62-mmrp-gwqw

Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload

Priority HIGH 73

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2023-12-04 Fixed in 2.9.5 CWE-434
TI-2023-05483 CVE-2023-5952 · GHSA-55r4-r6gc-57rx

Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection

Priority MEDIUM 45

The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01253 Published 2023-12-04 Fixed in 2.9.5