Vulnerability · Published Jan 15, 2026 · Assigned by VulnCheck
CVE-2021-47769Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)
Medium 4.8
In plain English
A medium-severity cross-site scripting in Isshue Shopping Cart from Bdtask. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.3%top 78.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bdtask | Isshue Shopping Cart | 3.5 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
References
- ExploitDB-50490 exploit
- Vulnerability-Lab Disclosure technical-description, exploit
- Official Product Homepage product