WordPress Plugin TheCartPress eCommerce Shopping Cart Multiple Vulnerabilities - CVE-2015-3301

WordPress Plugin TheCartPress eCommerce Shopping Cart is prone to multiple vulnerabilities including cross-site scripting cross-site request forgery local file inclusion and security bypass vulnerabilities. Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site allowing the attacker to steal cookie-based authentication credentials and launch other attacks to gain unauthorized access to the affected application to obtain sensitive information or to perform otherwise restricted actions and subsequently browse orders of other users or steal all currently-existing orders. WordPress Plugin TheCartPress eCommerce Shopping Cart version 1.3.9 is vulnerable prior versions may also be affected.