CVE-2015-3421

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/74477Third Party Advisory, VDB Entry
https://www.htbridge.com/advisory/HTB23255Third Party Advisory
http://www.securityfocus.com/bid/74477Third Party Advisory, VDB Entry
https://www.htbridge.com/advisory/HTB23255Third Party Advisory

Timeline

Published: Jul 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-34224.3Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the m CVE-2015-34238.8Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbit CVE-2015-34248.8SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute CVE-2015-34256.1Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to CVE-2015-34277.5Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote at CVE-2015-34294.3Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attack CVE-2015-34319.8Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Comman CVE-2015-34326.1Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary w CVE-2015-343510.0Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2)CVE-2015-34366.6provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbi CVE-2015-34384.3Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attacker CVE-2015-34394.3Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3