CVE-2018-0657: Ec-Cube Payment Module

Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.

Affected products

• Ec-Cube Ec-Cube Payment Module: up to and including 2.3.17; up to and including 3.5.23
• Gmo-Pg Gmo-Pg Payment Module: up to and including 2.3.17; up to and including 3.5.23

Published 2018-09-07. Last modified 2026-06-17.