WP eCommerce is a WordPress-focused plugin ecosystem providing email delivery, donation processing, and e-commerce functionality to WordPress sites. The vendor's vulnerability disclosures span a narrow product range centered on these WordPress integrations, a deployment model that reaches a prominent share of WordPress-dependent web properties. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wp Ecommerce over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-35234HIGH The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/ | Dec 14, 2020 | 7.5 | 77 | NO | YES |
CVE-2019-25141CRITICAL The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() fu | Jun 7, 2023 | 9.8 | 41 | NO | YES |
CVE-2022-42699HIGH Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. | Dec 6, 2022 | 8.8 | 28 | NO | NO |
CVE-2022-45829HIGH Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress. | Dec 6, 2022 | 8.1 | 26 | NO | NO |
CVE-2022-3334HIGH The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or n | Oct 31, 2022 | 7.2 | 24 | NO | NO |
CVE-2024-1514HIGH The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3.15.1 due to insuffic | Feb 28, 2024 | 7.5 | 23 | NO | NO |
CVE-2022-45833MEDIUM Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. | Dec 6, 2022 | 6.5 | 23 | NO | NO |
CVE-2024-35676MEDIUM Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS.This issue aff | Jun 8, 2024 | 5.4 | 18 | NO | NO |
CVE-2017-7723MEDIUM XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body. | Apr 24, 2017 | 6.1 | 17 | NO | NO |
The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is | Jun 13, 2024 | 2.7 | 12 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wp Ecommerce.
Media articles that mention a CVE ID that affects a product developed by Wp Ecommerce — matched by CVE ID, not by vendor name.