CVE-2022-3935

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Welcart e-Commerce	< 2.8.4

References

https://wpscan.com/vulnerability/906c5122-dd6d-494b-b66c-4162e234ea05Exploit, Third Party Advisory
https://wpscan.com/vulnerability/906c5122-dd6d-494b-b66c-4162e234ea05Exploit, Third Party Advisory

Timeline

Published: Dec 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-393505.4@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allow CVE-2022-393514.4Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior CVE-2022-393529.8OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authori CVE-2022-393539.8xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not CVE-2022-393547.5SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` param CVE-2022-393559.8Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper auth CVE-2022-393568.8Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can ente CVE-2022-393579.8Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9 CVE-2022-393586.5Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent CVE-2022-393596.5Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSO CVE-2022-39364.8The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users su CVE-2022-393606.5Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on