plugin
31 known security issues reported for the Wp E Commerce WordPress plugin. Most recent disclosed Feb 13, 2026.
Running Wp E Commerce on your site? Check whether your installed version is affected.
Scan your site freeThe WP eCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.15.1. This is due to missing or incorrect nonce validation on the 'wpsc-product' post type page. This makes it possible for unauthenticated attackers to delete coupons via a forged request granted t...
The eCommerce plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.15.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via a...
[en] The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
[en] The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitrary posts with arbitrary content.
The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unaut...
The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitrary posts with arbitrary content.
The WP eCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘sessionid’ parameter in versions up to, and including, 3.11.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to ap...
The WP eCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘sessionid’ parameter in versions up to, and including, 3.11.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to ap...
The WP eCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'add_query_arg()' and 'remove_query_arg()' functions in versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
The WP eCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'add_query_arg()' and 'remove_query_arg()' functions in versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
The WP eCommerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various functions called via AJAX actions and admin_init hooks in versions up to, and including, 3.8.14.3. This makes it possible for unauthenticated attackers to perform a plethora of actions like exporting...
The WP eCommerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various functions called via AJAX actions and admin_init hooks in versions up to, and including, 3.8.14.3. This makes it possible for unauthenticated attackers to perform a plethora of actions like exporting...
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The WP eCommerce plugin for WordPress is vulnerable to generic SQL Injection via the ‘view_purchlogs_by_status’ parameter in versions up to, and including, 3.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthen...
The WP eCommerce plugin for WordPress is vulnerable to Cross-Site Scripting via the 'm' parameter in versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
The WP eCommerce plugin for WordPress is vulnerable to Cross-Site Scripting via the 'm' parameter in versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
The WP eCommerce plugin for WordPress is vulnerable to generic SQL Injection via the ‘view_purchlogs_by_status’ parameter in versions up to, and including, 3.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthen...
WP e-Commerce plugin is prone to multiple security vulnerabilities, such as a local file include, arbitrary file upload and multiple remote code execution vulnerabilities. An attacker can upload arbitrary files to the affected computer that may result in arbitrary code execution within the context of the vulnerable app...
[en] SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[en] Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.
Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.
This WordPress e-Commerce plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Upgrade the plugin.
WordPress WP e-Commerce plugin's "cart_messages[]" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-base...
From vendor: "This vulnerability only affects users who use eWay as their payment gateway, have Gold Cart activated, and are using the as-of-yet-unreleased Theme Engine 2.0. We believe the number of users affected is likely close to zero, due to these conditions – but still, we highly recommend updating.&qu...
The WP eCommerce WordPress plugin was affected by a Reflected Cross-Site Scripting (XSS) security vulnerability.
The WP eCommerce WordPress plugin was affected by a SQL Injection security vulnerability.
The WP eCommerce WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
The WP eCommerce WordPress plugin was affected by an Authorisation Bypass security vulnerability.
The WP eCommerce WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
The WP eCommerce WordPress plugin was affected by a SQL Injection security vulnerability.
The WP eCommerce WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free