Thecartpress

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:thecartpress:thecartpress:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorThecartpress (75906da7-0b9e-59a7-a218-4dae0d7174ed)
ProductThecartpress (c2a93fbc-e5fc-5de9-a5e1-68f2632f1706)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/tcp-sensei/thecartpress purl2cpe 2026-06-01 10:16:53.205842
pkg:github/wp-plugins/thecartpress purl2cpe 2026-06-01 10:16:53.205846
pkg:github/wpplugins/thecartpress purl2cpe 2026-06-01 10:16:53.205848

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-47932 vulnerable 2026-06-08 05:38:07.927639 WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated
CRITICAL (9.8)
WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.
Published: 2026-05-10T12:43:52.728Z
Updated: 2026-07-15T01:24:39.650Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-5207 vulnerable 2026-06-08 04:59:35.106907 Details available
Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12-31 allows remote attackers to inject arbitrary web script or HTML via the tcp_name_post_XXXXX parameter.
Published: 2012-10-04T17:00:00.000Z
Updated: 2024-08-07T00:30:46.860Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.