CVE-2021-20735

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-22 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.

Affected products

Ec-Cube Delivery Slip Number: through 1.0.10
Ec-Cube Delivery Slip Number Csv Bulk Registration: through 1.0.8
Ec-Cube Delivery Slip Number Mail: through 1.0.8

References

https://jvn.jp/en/jp/JVN79254445/index.html
https://www.ec-cube.net/release/detail.php?release_id=5087
https://www.ec-cube.net/release/detail.php?release_id=5088
https://www.ec-cube.net/release/detail.php?release_id=5089
https://jvn.jp/en/jp/JVN79254445/index.html
https://www.ec-cube.net/release/detail.php?release_id=5087
https://www.ec-cube.net/release/detail.php?release_id=5088
https://www.ec-cube.net/release/detail.php?release_id=5089

Get alerted when CVE-2021-20735 or the next vulnerability affects your stack