CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Stored XSS.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.
Explanation of Vulnerability in Simple Terms
Ecwid Shopping Cart versions 7.0 and earlier contain a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts. The vulnerability requires user interaction and can affect other users viewing the same content. An attacker with low-level account access can craft a malicious request to compromise site visitors' sessions or steal sensitive data.
What an attacker can do
Inject malicious JavaScript that executes in other users' browsers and steals their session data or credentials.
Potential impact on your site
Site visitors' accounts and data can be compromised if they interact with injected content; customer trust and PCI compliance may be affected.
Conditions required to exploit
Attacker needs a low-privilege account on the site and must trick a user into clicking a malicious link or visiting a crafted page.
Key dates
External resources
