CVE-2013-5977

CVE-2013-5977 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Cart66 Lite plugin for WordPress, specifically in versions prior to 1.5.1.15. This flaw allows remote attackers to hijack administrator authentication, enabling them to create or modify products, or conduct cross-site scripting (XSS) attacks through manipulated product name or price description fields. With a CVSS score of 6.8, this vulnerability is of medium severity, requiring user interaction (AC:M) but not authentication (Au:N), and can lead to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). While there is an ExploitDB entry (EDB-28959) referencing multiple vulnerabilities in Cart66 1.5.1.14, there is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.