CVE-2013-5977 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 3.2% (pctl 88)
Patch early
A public exploit exists.
Description
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 3.15% — more likely to be exploited than 88% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2013-11-01 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| cart66 | cart66 lite plugin |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin Cart66 1.5.1.14 - Multiple Vulnerabilities | 2013-10-14 |
References
- http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html
- http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html
- http://osvdb.org/98352
- http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
- http://seclists.org/bugtraq/2013/Oct/52
- http://secunia.com/advisories/55265
- http://wordpress.org/plugins/cart66-lite/changelog/
- http://www.exploit-db.com/exploits/28959
- http://www.securityfocus.com/bid/62975
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87874
- http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html
- http://blog.noobroot.com/#%21/2013/10/0-day-wordpress-cart66-plugin-15114.html
- http://osvdb.org/98352
- http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
- http://seclists.org/bugtraq/2013/Oct/52
- http://secunia.com/advisories/55265
- http://wordpress.org/plugins/cart66-lite/changelog/
- http://www.exploit-db.com/exploits/28959
- http://www.securityfocus.com/bid/62975
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87874
→ the Explorer · watch your stack · NVD