Skip to content
OpenAdvisories

Product · mra13

Simple Shopping Cart

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-0552

    Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode

    The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsc_display_product' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplie…

    mra13 Simple Shopping Cart Web / CMS
  • Medium 6.4
    CVE-2025-3890

    WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user sup…

    mra13 Simple Shopping Cart Web / CMS
  • Medium 5.3
    CVE-2025-3889

    WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for…

    mra13 Simple Shopping Cart Web / CMS
  • Medium 6.5
    CVE-2025-3874

    WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers t…

    mra13 Simple Shopping Cart Web / CMS
  • Medium 6.4
    CVE-2024-12622

    WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' and 'wp_cart_display_product' shortcodes in all versions up to, and including, 5.0.7 due to insufficient input sanitization …

    mra13 Simple Shopping Cart Web / CMS
  • Medium 4.4
    CVE-2023-6497

    WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. This makes it pos…

    mra13 Simple Shopping Cart Web / CMS