JVN#19766555
Multiple vulnerabilities in WordPress plugin "Welcart e-Commerce"

Overview

WordPress plugin "Welcart e-Commerce" provided by Welcart Inc. contains multiple vulnerabilities.

Products Affected

• Welcart e-Commerce versions prior to 2.11.2

Description

WordPress plugin "Welcart e-Commerce" provided by Welcart Inc. contains multiple vulnerabilities listed below.

• SQL injection (CWE-89)
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.8
  • CVE-2024-42404
• Cross-site scripting (CWE-79)
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score 6.1
  • CVE-2024-45366

Impact

• An attacker who can login to the product may obtain or alter the information stored in the database  (CVE-2024-42404)
• An arbitrary script may be executed on the user's web browser (CVE-2024-45366)

Solution

Update the plugin
Update the plugin according to the information provided by the developer.
The developer has released the following version that addresses these vulnerabilities.

• Welcart e-Commerce 2.11.2