Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: mra13 Component: Wordpress Simple Paypal Shopping Cart Clear all filters
TI-2025-03437 CVE-2025-3890 · GHSA-g58j-9633-p589

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanit…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00286 Published 2025-05-01 No fix listed CWE-79
TI-2025-03422 CVE-2025-3874 · GHSA-x26p-4qc2-77fw

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference

Priority LOW 35

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00414 Published 2025-05-01 No fix listed CWE-639
TI-2025-03436 CVE-2025-3889 · GHSA-cp88-7fch-35v3

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'

Priority LOW 30

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user con…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00366 Published 2025-05-01 No fix listed CWE-639
TI-2023-05954 CVE-2023-6497 · GHSA-cvpg-3pfh-m39w

WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting

Priority LOW 22

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00301 Published 2024-01-27 No fix listed CWE-79
TI-2022-04270 CVE-2022-4672 · GHSA-jx46-9ppx-mm7j

WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contri…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00539 Published 2023-01-23 Fixed in 4.6.2
TI-2013-02366 CVE-2013-2705 · GHSA-qq9m-8xc8-6v76

Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping…

Priority LOW 32

Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01076 Published 2014-05-13 No fix listed CWE-352