WordPress plugin
WP EasyCart: Shopping Cart and eCommerce Store security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 26 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High8
- Medium18
- Low0
All WP EasyCart: Shopping Cart and eCommerce Store vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action ≤5.9.3Update to 5.9.4 | CVE-2026-17553 | |
| High8.8 | Authenticated (Contributor+) SQL Injection via model_number Parameter ≤5.7.2Update to 5.7.3 | CVE-2024-7827 | |
| High8.8 | Authenticated (Contributor+) SQL Injection ≤5.6.3Update to 5.6.4 | CVE-2024-3211 | |
| High7.2 | Authenticated (Administrator+) SQL Injection via 'orderby' ≤5.4.10Update to 5.4.11 | CVE-2023-3023 | |
| High7.2 | Authenticated (Admin+) Local File Inclusion via import_file_url ≤5.4.2Update to 5.4.3 | CVE-2023-1124 | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting ≤5.1.0Update to 5.1.5 | CVE-2021-34645 | |
| High8.8 | 3.0.20 - Privilege Escalation 1.1.30 – 3.0.20Update to 3.0.21 | CVE-2015-2673 | |
| High8.8 | Arbitrary File Upload <3.0.16Update to 3.0.16 | CVE-2014-9308 |
- High7.2Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
≤5.9.3Update to 5.9.4
- High8.8Authenticated (Contributor+) SQL Injection via model_number Parameter
≤5.7.2Update to 5.7.3
- High8.8Authenticated (Contributor+) SQL Injection
≤5.6.3Update to 5.6.4
- High7.2Authenticated (Administrator+) SQL Injection via 'orderby'
≤5.4.10Update to 5.4.11
- High7.2Authenticated (Admin+) Local File Inclusion via import_file_url
≤5.4.2Update to 5.4.3
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
≤5.1.0Update to 5.1.5
- High8.83.0.20 - Privilege Escalation
1.1.30 – 3.0.20Update to 3.0.21
- High8.8Arbitrary File Upload
<3.0.16Update to 3.0.16
WP EasyCart: Shopping Cart and eCommerce Store: common questions
Does WP EasyCart: Shopping Cart and eCommerce Store have known vulnerabilities?
Yes. VulnCrest Radar lists 26 known vulnerabilities in WP EasyCart: Shopping Cart and eCommerce Store: 8 high, 18 medium. None are known to affect version null.
How do I check which version of WP EasyCart: Shopping Cart and eCommerce Store I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP EasyCart: Shopping Cart and eCommerce Store vulnerability?
CVE-2026-94124, published Sep 23, 2026: Shopping Cart & eCommerce Store <= 5.9.4 - Authenticated (Contributor+) SQL Injection. Severity: Medium (CVSS 6.5).
Is any WP EasyCart: Shopping Cart and eCommerce Store vulnerability listed in CISA KEV?
No. None of the known WP EasyCart: Shopping Cart and eCommerce Store vulnerabilities is currently listed in the CISA KEV catalog.