WordPress plugin
Simple Shopping Cart security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium13
- Low0
All Simple Shopping Cart vulnerabilities
- Medium4.35.3.2 - Authenticated (Contributor+) Payment Bypass
5.1.3 – 5.3.2Update to 5.3.3
- Medium5.3Unauthenticated Payment Bypass
≤5.3.2Update to 5.3.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.2.5Update to 5.2.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
≤5.2.9Update to 5.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode
≤5.2.4Update to 5.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤5.1.3Update to 5.1.4
- Medium5.3Insecure Direct Object Reference via 'quantity'
≤5.1.3Update to 5.1.4
- Medium6.5Insecure Direct Object Reference
≤5.1.3Update to 5.1.4
- High7.5Unauthenticated Product Price Manipulation
≤5.1.2Update to 5.1.3
- High8.2Unauthenticated Information Exposure via file_url Parameter
≤5.1.2Update to 5.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.0.7Update to 5.0.8
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
≤4.7.1Update to 4.7.2
- Medium5.3Information Disclosure
4.6.3 – 4.6.3Update to 4.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.6.1Update to 4.6.2
- Medium4.7Cross-Site Request Forgery
<3.6Update to 3.6
Simple Shopping Cart: common questions
Does Simple Shopping Cart have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in Simple Shopping Cart: 2 high, 13 medium. None are known to affect version null.
How do I check which version of Simple Shopping Cart I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Simple Shopping Cart vulnerability?
CVE-2026-104642, published Oct 19, 2026: Simple Shopping Cart 5.1.3 - 5.3.2 - Authenticated (Contributor+) Payment Bypass. Severity: Medium (CVSS 4.3).
Is any Simple Shopping Cart vulnerability listed in CISA KEV?
No. None of the known Simple Shopping Cart vulnerabilities is currently listed in the CISA KEV catalog.