Threats tagged 'ghsa-8pvj-wmxx-5r34'

The Welcart e-Commerce plugin for WordPress versions up to and including 2.12.5 is vulnerable to stored cross-site scripting (XSS) via the 'gid' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The attack involves forging a ROBOT PAYMENT browser-return request to store a malicious 'gid' value in order metadata, which executes when an administrator views the order in the WordPress admin panel.