NVD

Id
25170  
Name
CVE-2015-3300  
Description
Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (34) post_type parameter in the admin/CustomFieldsList.php page to wp-admin/admin.php.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-05-14  
Modified Date
2016-11-28  
Seq
2015-3300  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
133130 25170 CVE-2015-3300 http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html  View
133131 25170 CVE-2015-3300 20150429 Multiple Vulnerabilities in TheCartPress WordPress plugin  View
133132 25170 CVE-2015-3300 74395  View
133133 25170 CVE-2015-3300 https://wordpress.org/plugins/thecartpress/changelog/  View
133134 25170 CVE-2015-3300 36860  View
133135 25170 CVE-2015-3300 https://www.htbridge.com/advisory/HTB23254  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7371 JVNDB-2015-002691 WordPress 用 TheCartPress eCommerce Shopping Cart プラグインにおけるクロスサイトスクリプティングの脆弱性 WordPress 用 TheCartPress eCommerce Shopping Cart (別名 The Professional WordPress eCommerce Plugin) プラグインには、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2015-3300 80525 CVE-2015-3300 25170 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002691.html 2015-05-03 2015-05-19 View