CVE-2013-5978: XSS
First published: Wed Dec 11 2019(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cart66 Lite | <=1.5.1.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html
- http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
- http://seclists.org/bugtraq/2013/Oct/52
- http://wordpress.org/plugins/cart66-lite/changelog
- http://www.exploit-db.com/exploits/28959
- http://www.securityfocus.com/bid/62977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87873
Frequently Asked Questions
What is the severity of CVE-2013-5978?
CVE-2013-5978 is considered to have a medium severity due to the potential for remote code execution via cross-site scripting.
How do I fix CVE-2013-5978?
To mitigate CVE-2013-5978, update the Cart66 Lite plugin to version 1.5.1.15 or later.
What types of attacks are possible through CVE-2013-5978?
CVE-2013-5978 allows attackers to perform cross-site scripting (XSS) attacks by injecting malicious scripts into product name or price description fields.
Who is affected by CVE-2013-5978?
Users of the Cart66 Lite plugin for WordPress versions prior to 1.5.1.15 are affected by CVE-2013-5978.
Is user input safe in applications vulnerable to CVE-2013-5978?
No, user input is not safe in applications vulnerable to CVE-2013-5978, as it can be exploited to execute arbitrary scripts.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cart66
- canonical/cart66 lite
- version/cart66 lite/1.5.1.14