WordPress CVEs

Description

Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.

Affected WordPress components

• cart66-lite Plugin · cart66-lite
  Confirmed match Homeless
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• cart66 cart66_lite_plugin — Up to and including 1.5.1.14
• cart66 cart66_lite_plugin — Version 1.0.7
• cart66 cart66_lite_plugin — Version 1.0.8
• cart66 cart66_lite_plugin — Version 1.1
• cart66 cart66_lite_plugin — Version 1.1.1
• cart66 cart66_lite_plugin — Version 1.1.2
• cart66 cart66_lite_plugin — Version 1.1.3
• cart66 cart66_lite_plugin — Version 1.1.4
• cart66 cart66_lite_plugin — Version 1.1.5
• cart66 cart66_lite_plugin — Version 1.1.6
• cart66 cart66_lite_plugin — Version 1.3.0
• cart66 cart66_lite_plugin — Version 1.4.0
• cart66 cart66_lite_plugin — Version 1.4.1
• cart66 cart66_lite_plugin — Version 1.4.2
• cart66 cart66_lite_plugin — Version 1.4.4
• cart66 cart66_lite_plugin — Version 1.4.7
• cart66 cart66_lite_plugin — Version 1.4.8
• cart66 cart66_lite_plugin — Version 1.4.9
• cart66 cart66_lite_plugin — Version 1.5.0
• cart66 cart66_lite_plugin — Version 1.5.0.1
• cart66 cart66_lite_plugin — Version 1.5.0.2
• cart66 cart66_lite_plugin — Version 1.5.1
• cart66 cart66_lite_plugin — Version 1.5.1.1
• cart66 cart66_lite_plugin — Version 1.5.1.2
• cart66 cart66_lite_plugin — Version 1.5.1.8

References

• archives.neohapsis.com http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html Exploit
• blog.noobroot.com http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html
• osvdb.org http://osvdb.org/98352
• packetstormsecurity.com http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html Exploit
• seclists.org http://seclists.org/bugtraq/2013/Oct/52 Exploit
• secunia.com http://secunia.com/advisories/55265 Vendor Advisory
• wordpress.org http://wordpress.org/plugins/cart66-lite/changelog/
• www.exploit-db.com http://www.exploit-db.com/exploits/28959 Exploit
• www.securityfocus.com http://www.securityfocus.com/bid/62975
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/87874
• nvd.nist.gov Official NVD record