CVE-2013-5978

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.htmlBroken Link
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/bugtraq/2013/Oct/52Mailing List, Third Party Advisory
http://wordpress.org/plugins/cart66-lite/changelogRelease Notes, Third Party Advisory
http://www.exploit-db.com/exploits/28959Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/62977Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87873Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.htmlBroken Link
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/bugtraq/2013/Oct/52Mailing List, Third Party Advisory
http://wordpress.org/plugins/cart66-lite/changelogRelease Notes, Third Party Advisory
http://www.exploit-db.com/exploits/28959Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/62977Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87873Third Party Advisory, VDB Entry

Timeline

Published: Dec 11, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-59795.0Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary CVE-2013-59834.3Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via CVE-2013-59846.4Directory traversal vulnerability in userfiles/modules/admin/backup/delete.php in Microweber before 0.830 allows remote attackers to delete CVE-2013-598610.0Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 has unknown impact and attack vectors, a different v CVE-2013-59877.2Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass intended access restric CVE-2013-59886.1A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.CVE-2013-59909.3Unspecified vulnerability in JustSystems Ichitaro 2006 through 2011; Ichitaro Government 6, 7, and 2006 through 2010; Ichitaro 2011 Sou; Ich CVE-2013-59914.3The displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive CVE-2013-59924.3Cross-site scripting (XSS) vulnerability in the displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 CVE-2013-59936.8Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication CVE-2013-59945.0data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive CVE-2013-59955.5data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authentic