CVE-2021-47856

Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content.

CVSS v4.0

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 24th percentile

Published

2026-02-01

Updated

2026-02-02

Proof-of-concept exploits (1)

• https://www.vulnerability-lab.com/get_content.php?id=2298

References

• CVE Record
• NVD entry

Related

• CVE-2021-47855
• CVE-2021-47857
• CVE-2021-47854
• CVE-2021-47858
• CVE-2021-47852
• CVE-2021-47859