CVE-2015-3421
MEDIUMWordpress Eshop <6.3.11 - XSS
Title source: llmDescription
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
Scores
CVSS v3
6.1
EPSS
0.0017
EPSS Percentile
38.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
eshop_project/eshop
< 6.3.11
n/a/n/a
Published
Jul 21, 2017
Tracked Since
Feb 18, 2026