https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-23797.htmlhttps://patchthecve.com/cve/CVE-2026-23797.htmlWed, 17 Jun 2026 10:22:06 +0000MEDIUM 4.9: In Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 wahttps://patchthecve.com/cve/CVE-2026-23796.htmlhttps://patchthecve.com/cve/CVE-2026-23796.htmlWed, 17 Jun 2026 10:22:06 +0000CRITICAL 9.8: Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vhttps://patchthecve.com/cve/CVE-2025-67684.htmlhttps://patchthecve.com/cve/CVE-2025-67684.htmlWed, 17 Jun 2026 09:57:59 +0000HIGH 7.2: Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include and execute uploaded PHP code, resultinghttps://patchthecve.com/cve/CVE-2025-67683.htmlhttps://patchthecve.com/cve/CVE-2025-67683.htmlWed, 17 Jun 2026 09:57:59 +0000MEDIUM 6.1: Quick.Cart is vulnerable to reflected XSS via the sSort parameter. An attacker can craft a malicious URL which, when opened, results in arbitrary JavaScript execution in the victim’s browser. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerabilit