WordPress plugin
WP EasyCart: Shopping Cart and eCommerce Store security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 26 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High8
- Medium18
- Low0
All WP EasyCart: Shopping Cart and eCommerce Store vulnerabilities
- Medium6.5Authenticated (Contributor+) SQL Injection
≤5.9.4Update to 6.0.0
- High7.2Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
≤5.9.3Update to 5.9.4
- Medium4.9Authenticated (Administrator+) SQL Injection via 'product_order' Parameter
≤5.9.2Update to 5.9.3
- Medium6.5Authenticated (Contributor+) SQL Injection
≤5.9.1Update to 5.9.2
- Medium6.5Authenticated (Contributor+) SQL Injection
≤5.8.13Update to 5.8.14
- Medium5.3Unauthenticated Information Exposure
≤5.8.11Update to 5.8.12
- Medium5.3Missing Authorization to Order Updates
≤5.7.8Update to 5.7.9
- High8.8Authenticated (Contributor+) SQL Injection via model_number Parameter
≤5.7.2Update to 5.7.3
- Medium5.3Missing Authorization
≤5.5.19Update to 5.6.0
- Medium5.3Sensitive Information Exposure
≤5.6.4Update to 5.6.5
- Medium4.3Cross-Site Request Forgery
≤5.5.19Update to 5.6.0
- High8.8Authenticated (Contributor+) SQL Injection
≤5.6.3Update to 5.6.4
- High7.2Authenticated (Administrator+) SQL Injection via 'orderby'
≤5.4.10Update to 5.4.11
- Medium4.3Cross-Site Request Forgery via process_bulk_deactivate_product
≤5.4.8Update to 5.4.9
- Medium4.3Cross-Site Request Forgery via process_duplicate_product
≤5.4.8Update to 5.4.9
- Medium4.3Cross-Site Request Forgery via process_deactivate_product
≤5.4.8Update to 5.4.9
- Medium6.5Cross-Site Request Forgery via process_delete_product
≤5.4.8Update to 5.4.9
- Medium4.3Cross-Site Request Forgery via process_bulk_activate_product
≤5.4.8Update to 5.4.9
- Medium6.5Cross-Site Request Forgery via process_bulk_delete_product
≤5.4.8Update to 5.4.9
- High7.2Authenticated (Admin+) Local File Inclusion via import_file_url
≤5.4.2Update to 5.4.3
- Medium6.3Cross-Site Request Forgery
≤5.2.6Update to 5.3.0
- Medium6.5Cross-Site Request Forgery to Settings Update
≤5.2.4Update to 5.2.5
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
≤5.1.0Update to 5.1.5
- High8.83.0.20 - Privilege Escalation
1.1.30 – 3.0.20Update to 3.0.21
- High8.8Arbitrary File Upload
<3.0.16Update to 3.0.16
- Medium5.3Sensitive Information Disclosure
≤2.0.5Update to 2.0.6
WP EasyCart: Shopping Cart and eCommerce Store: common questions
Does WP EasyCart: Shopping Cart and eCommerce Store have known vulnerabilities?
Yes. VulnCrest Radar lists 26 known vulnerabilities in WP EasyCart: Shopping Cart and eCommerce Store: 8 high, 18 medium. None are known to affect version null.
How do I check which version of WP EasyCart: Shopping Cart and eCommerce Store I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP EasyCart: Shopping Cart and eCommerce Store vulnerability?
CVE-2026-94124, published Sep 23, 2026: Shopping Cart & eCommerce Store <= 5.9.4 - Authenticated (Contributor+) SQL Injection. Severity: Medium (CVSS 6.5).
Is any WP EasyCart: Shopping Cart and eCommerce Store vulnerability listed in CISA KEV?
No. None of the known WP EasyCart: Shopping Cart and eCommerce Store vulnerabilities is currently listed in the CISA KEV catalog.