CoCart vulnerabilities
We track 2 vulnerabilities in CoCart products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 4, 2026.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest CoCart vulnerabilities
- 8.8 High severity
CoCart: Cross-Site Request Forgery
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that cre
- 7.5 High severity
CoCart: External Control of Assumed-Immutable Web Parameter
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product price