CVE-2013-5978

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.1%

from disclosure to weapon0 days

Published on NVDDec 11

1st PoCOct 14

exploitation probability

4.1%top 10% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/28959 cve_referencewww.exploit-db.com/exploits/28959unverified cve_referencepacketstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html http://seclists.org/bugtraq/2013/Oct/52 https://exchange.xforce.ibmcloud.com/vulnerabilities/87873 http://wordpress.org/plugins/cart66-lite/changelog http://www.exploit-db.com/exploits/28959 http://www.securityfocus.com/bid/62977