CVE-2014-10016: XSS

Published Jan 13, 2015

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchaselimit or the (2) name, (3) intl, (4) nocod, or (5) time parameter in an adddeliverymethod action to wp-admin/admin-ajax.php.

Affected Software

1 affected component

Welcart E-commerce Wordpress=1.3.12

Event History

Jan 13, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-10016?

The severity of CVE-2014-10016 is considered medium due to its potential for exploiting cross-site scripting vulnerabilities.

How do I fix CVE-2014-10016?

To fix CVE-2014-10016, update the Welcart e-Commerce plugin to a version that addresses the XSS vulnerabilities.

What types of attacks can CVE-2014-10016 facilitate?

CVE-2014-10016 can facilitate cross-site scripting attacks that allow attackers to inject arbitrary web scripts or HTML.

Which software is affected by CVE-2014-10016?

CVE-2014-10016 specifically affects the Welcart e-Commerce plugin version 1.3.12 designed for WordPress.

What parameters are associated with the vulnerabilities in CVE-2014-10016?

The CVE-2014-10016 vulnerabilities are associated with parameters such as purchase_limit, name, intl, nocod, and time.