CVE-2015-3421: Eshop Project Eshop

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.

Affected products

• Eshop Project Eshop: up to and including 6.3.11

Published 2017-07-21. Last modified 2026-06-17.