Vulnerabilities

TI-2022-03618 CVE-2022-3946 · GHSA-jqx9-j9f6-5vqg

Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion

MEDIUM 62

The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00345 Published 2022-12-12 Fixed in 2.8.4 CWE-352

TI-2022-03608 CVE-2022-3935 · GHSA-cchx-3mjj-hjj4

Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting

MEDIUM 58

The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00491 Published 2022-12-12 Fixed in 2.8.4

Vulnerabilities

Filters

Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion

Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting