Thecartpress Ecommerce Shopping Cart
Approved changes feed: RSS · Atom
cpe:2.3:a:thecartpress:thecartpress_ecommerce_shopping_cart:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Thecartpress (75906da7-0b9e-59a7-a218-4dae0d7174ed) |
|---|---|
| Product | Thecartpress Ecommerce Shopping Cart (554067e0-4100-54ad-ad3d-c0594cb59fbe) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2015-3986 |
vulnerable | 2026-06-08 05:06:38.946693 |
Details available
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Published: 2015-05-14T14:00:00.000Z
Updated: 2024-08-06T06:04:02.810Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3302 |
vulnerable | 2026-06-08 05:06:37.945126 |
Details available
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Published: 2017-12-29T22:00:00.000Z
Updated: 2024-08-06T05:39:32.106Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3301 |
vulnerable | 2026-06-08 05:06:37.944750 |
Details available
Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Published: 2015-05-14T14:00:00.000Z
Updated: 2024-08-06T05:39:32.146Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3300 |
vulnerable | 2026-06-08 05:06:37.944293 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (34) post_type parameter in the admin/CustomFieldsList.php page to wp-admin/admin.php.
Published: 2015-05-14T14:00:00.000Z
Updated: 2024-08-06T05:39:32.134Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.