Aller au contenu
Se connecter
3.5 Faible

CVE-2026-104119 The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before…

Description

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

Produits et versions touchés

Produit Versions touchées Corrigé en
Simple Shopping Cart 5.2 premières → < 5.2.6 5.2.6

Autres CVE de Simple Shopping Cart

Les 3 CVE de Simple Shopping Cart →
CVE-2026-104642 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the… 2.7 Faible CVE-2026-104641 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a… 5.3 Moyenne
Suivre cette CVE