CVE-2026-6370

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6370", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-15T16:00:56.964Z", "datePublished": "2026-04-15T16:02:14.957Z", "dateUpdated": "2026-04-16T14:09:47.438Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-15T16:02:14.957Z"}, "title": "WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"vendor": "HashThemes", "product": "Mini Ajax Cart for WooCommerce", "collectionURL": "https://wordpress.org/plugins", "packageName": "mini-ajax-woo-cart", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "1.3.4", "changes": [{"at": "1.3.5", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.<p>This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/mini-ajax-woo-cart/vulnerability/wordpress-mini-ajax-cart-for-woocommerce-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "Update the WordPress Mini Ajax Cart for WooCommerce Plugin to the latest available version (at least 1.3.5).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress Mini Ajax Cart for WooCommerce Plugin to the latest available version (at least 1.3.5)."}]}], "credits": [{"lang": "en", "value": "Ali Osman ERBAS (0110m4n) | Patchstack Bug Bounty Program", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T14:08:31.970223Z", "id": "CVE-2026-6370", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:09:47.438Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6370", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-15T16:00:56.964Z", "datePublished": "2026-04-15T16:02:14.957Z", "dateUpdated": "2026-04-16T14:09:47.438Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-15T16:02:14.957Z"}, "title": "WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"vendor": "HashThemes", "product": "Mini Ajax Cart for WooCommerce", "collectionURL": "https://wordpress.org/plugins", "packageName": "mini-ajax-woo-cart", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "1.3.4", "changes": [{"at": "1.3.5", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.<p>This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/mini-ajax-woo-cart/vulnerability/wordpress-mini-ajax-cart-for-woocommerce-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "Update the WordPress Mini Ajax Cart for WooCommerce Plugin to the latest available version (at least 1.3.5).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress Mini Ajax Cart for WooCommerce Plugin to the latest available version (at least 1.3.5)."}]}], "credits": [{"lang": "en", "value": "Ali Osman ERBAS (0110m4n) | Patchstack Bug Bounty Program", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6370", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T14:08:31.970223Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:08:59.290Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "mini-ajax-woo-cart", "product": "Mini Ajax Cart for WooCommerce", "vendor": "HashThemes", "versions": [{"changes": [{"at": "1.3.5", "status": "unaffected"}], "lessThanOrEqual": "1.3.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web (\u2019cross-site scripting\u2019) en HashThemes Mini Ajax Cart para WooCommerce permite XSS Almacenado. Este problema afecta a Mini Ajax Cart para WooCommerce: desde n/d hasta 1.3.4."}], "id": "CVE-2026-6370", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6370", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T14:08:31.970223Z", "version": "2.0.3"}}]}, "published": "2026-04-15T17:17:06.387", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/mini-ajax-woo-cart/vulnerability/wordpress-mini-ajax-cart-for-woocommerce-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Mini Ajax Cart for WooCommerce", "source": "cna", "vendor": "HashThemes"}, "product": "mini_ajax_cart_for_woocommerce", "vendor": "hashthemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T19:21:56.479437+00:00", "value": {"mitigation_remediation": ["Update the WordPress Mini Ajax Cart for WooCommerce Plugin to version\u00a01.3.5 or later.", "Configure a web application firewall or similar filtering to block or sanitize script payloads submitted to the cart fields.", "If the plugin is not essential, disable or remove it until a secure version is available."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Vendors: HashThemes; Product: Mini Ajax Cart for WooCommerce plugin. All releases up through 1.3.4 are affected, including the initial release through that version.", "description_and_impact": "The flaw is a stored cross\u2011site scripting vulnerability that allows an attacker to inject and store malicious JavaScript in the Mini Ajax Cart for WooCommerce plugin data. When users load the cart page, the unsanitized input is rendered in the browser, which can lead to defacement, cookie theft, or session hijacking. This weakness falls under the category of insecure input handling (CWE\u201179).", "risk_and_exploitability": "The CVSS v3.1 score is 5.9, indicating a medium severity issue. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. Likely attack paths involve submitting malicious data through the cart interfaces, which is stored and later displayed to any user who views the cart. While the flaw does not provide direct server\u2010side code execution or privilege escalation, an attacker can compromise the browsing session of any visitor to the site."}}}}, "created": "2026-04-15T19:30:12.382847+00:00", "updated": "2026-04-15T21:02:25.351999+00:00", "vendors": ["hashthemes", "hashthemes$PRODUCT$mini_ajax_cart_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}