4.3
Medium
CVE-2021-4392 The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in…
Description
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated attackers to save product meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| eCommerce Product Catalog Plugin for WordPress 2.9 | earliest → < 2.9.44 | 2.9.44 |
Other CVEs of eCommerce Product Catalog Plugin for WordPress
The 7 CVEs of eCommerce Product Catalog Plugin for WordPress →
CVE-2024-12771
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in…
8.8
High
CVE-2023-51688
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin…
5.3
Medium
CVE-2023-47839
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode…
6.5
Medium
CVE-2021-4393
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in…
4.3
Medium