Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin...

4.3 CVSS

Vulnerability Description

Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-5104

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from getshopped

View All →

CVE-2012-5310

SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6...

High 7.5

Affected Vendor

getshopped

View all reports →

Affected Software

wp e-commerce

Vulnerable Versions:

0, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.6.10, 3.6.11, 3.6.12, 3.6.13, 3.7, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.5.1, 3.7.5.2, 3.7.5.3, 3.7.6, 3.7.6.1, 3.7.6.2, 3.7.6.3, 3.7.6.4, 3.7.6.5, 3.7.6.6, 3.7.6.7, 3.7.6.9, 3.7.7, 3.7.8, 3.7.8.1, 3.7.8.2, 3.7.8.3, 3.8, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.6.1, 3.8.7

Timeline

Official Publish: August 23rd, 2012

Last Modified: August 7th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.