Threat Entry Updated 2025-05-20

CVE-2024-10563 - Woocommerce Cart Count Shortcode Plugin

The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN Woocommerce Cart Count Shortcode

CVE-2024-10563

MEDIUM CVSS 5.4 2025-02-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-12-14

CVE-2024-12517 - Woocommerce Cart Count Shortcode Plugin

The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Woocommerce Cart Count Shortcode

CVE-2024-12517

MEDIUM CVSS 6.4 2024-12-14

Risk Score

Open Full Technical Breakdown