Lucene search
Erwan LR (WPScan)WPVDB-ID:81DC093A-545D-4BCD-AB85-EE9472D709E5HistoryNov 10, 2023 - 12:00 a.m.
Welcart e-Commerce < 2.9.5 - Reflected XSS
2023-11-1000:00:00
Erwan LR (WPScan)
wpscan.com
9
welcart e-commerce
reflected xss
parameter sanitization
cross-site scripting
admin privilege
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PoC
Make a logged in admin open the URL below: https://example.com/wp-admin/admin.php?page=usces_itemedit&action;=upload_register&upload;_mode=alert(/XSS/)
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 2.9.5 |
Related
prion
prion
Cross site scripting
2023-12-04 22:15:00
cvelist
cvelist
CVE-2023-5951 Welcart e-Commerce < 2.9.5 - Reflected XSS
2023-12-04 21:28:42
cve
cve
CVE-2023-5951
2023-12-04 22:15:08
nvd
nvd
CVE-2023-5951
2023-12-04 22:15:08
wpexploit
wpexploit
Welcart e-Commerce < 2.9.5 - Reflected XSS
2023-11-10 00:00:00
6.3 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.0%
Related for WPVDB-ID:81DC093A-545D-4BCD-AB85-EE9472D709E5