CVE-2013-5978

MEDIUM

Cart66 Lite Plugin < 1.5.1.14 - Cross-Site Scripting via Product Name or Price Description

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-5978. PoCs published by absane.

AI-analyzed exploit summary This exploit demonstrates a CSRF and stored XSS vulnerability in WordPress Cart66 Plugin 1.5.1.14. The PoC includes HTML/JavaScript to auto-submit a malicious product form, exploiting lack of CSRF tokens and input sanitization.

Description

Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.

Exploits (1)

exploitdb WORKING POC VERIFIED

by absane · textwebappsphp

https://www.exploit-db.com/exploits/28959

View Code ZIP pw:eip

This exploit demonstrates a CSRF and stored XSS vulnerability in WordPress Cart66 Plugin 1.5.1.14. The PoC includes HTML/JavaScript to auto-submit a malicious product form, exploiting lack of CSRF tokens and input sanitization.

Classification

Working Poc 100%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: WordPress Cart66 Plugin 1.5.1.14

Auth required

Prerequisites: Authenticated WordPress admin session · Victim interaction (clicking a link)

MITRE ATT&CK