WP EasyCart is a WordPress e-commerce plugin that provides shopping-cart and online-store functionality for small-to-medium web merchants, positioning itself within the widely deployed WordPress ecosystem. The recurring vulnerability patterns center on web-application input-handling and access-control deficiencies—cross-site request forgery, SQL injection, and improper file and directory access—typical of plugins that process commerce transactions and customer data; these weakness classes have a history of acquiring public exploit tooling and remaining active in security research. Defenders managing WordPress storefronts should treat this plugin's advisories with attention to patch timing and test thoroughly before deployment; current severity, exploitation activity, and CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wpeasycart over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-9308MEDIUM Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote auth | Jan 15, 2015 | 6.5 | 62 | NO | YES |
CVE-2015-2673HIGH The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote | Oct 6, 2017 | 8.8 | 41 | NO | YES |
CVE-2021-34645HIGH The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_ | Aug 19, 2021 | 8.8 | 26 | NO | NO |
CVE-2023-1124HIGH The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks. | Apr 3, 2023 | 7.2 | 24 | NO | NO |
CVE-2023-3023HIGH The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on | Jul 12, 2023 | 7.2 | 21 | NO | NO |
CVE-2023-2893MEDIUM The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on th | Jun 9, 2023 | 4.3 | 18 | NO | NO |
CVE-2023-2896MEDIUM The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on th | Jun 9, 2023 | 4.3 | 17 | NO | NO |
CVE-2023-2894MEDIUM The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on th | Jun 9, 2023 | 4.3 | 17 | NO | NO |
CVE-2023-2892MEDIUM The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on th | Jun 9, 2023 | 4.3 | 17 | NO | NO |
CVE-2023-2891MEDIUM The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on th | Jun 9, 2023 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wpeasycart.
Media articles that mention a CVE ID that affects a product developed by Wpeasycart — matched by CVE ID, not by vendor name.