Description (CNA)
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Simple Shopping Cart | affected 0 before 5.2.6 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.