Simple Shopping Cart

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Simple Shopping Cart

Information

Software Type Plugin
Software Slug wordpress-simple-paypal-shopping-cart (view on wordpress.org)
Software Status Active
Software Author mra13
Software Website www.tipsandtricks-hq.com
Software Downloads 2,073,195
Software Active Installs 10,000
Software Record Last Updated August 17, 2026

12 Vulnerabilities

Submit a Vulnerability
Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-48868
Jun 2, 2026
Researcher: Austin Ginder
Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode
6.4
CVE-2026-0552
Apr 3, 2026
Researcher: Muhammad Yudha - DJ
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-3890
Apr 30, 2025
Researcher: Jack Taylor
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'
5.3
CVE-2025-3889
Apr 30, 2025
Researcher: Jack Taylor
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference
6.5
CVE-2025-3874
Apr 30, 2025
Researcher: Jack Taylor
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation
7.5
CVE-2025-3530
Apr 22, 2025
Researcher: Jack Taylor
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter
8.2
CVE-2025-3529
Apr 22, 2025
Researcher: Jack Taylor
WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-12622
Dec 23, 2024
Researcher: Muhammad Yudha - DJ
WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-6497
Jan 26, 2024
Researcher: Webbernaut
WP Simple Shopping Cart <= 4.6.3 - Information Disclosure
5.3
CVE-2023-1431
Mar 16, 2023
Researcher: Ayoub Safa
WordPress Simple PayPal Shopping Cart <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2022-4672
Dec 27, 2022
Researcher: István Márton
WordPress Simple PayPal Shopping Cart < 3.6 - Cross-Site Request Forgery
4.7
CVE-2013-2705
Aug 1, 2014
Researchers:
Title Status CVE ID CVSS Researchers Date
Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference Patched CVE-2026-48868 5.3 Austin Ginder June 2, 2026
Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode Patched CVE-2026-0552 6.4 Muhammad Yudha - DJ April 3, 2026
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2025-3890 6.4 Jack Taylor April 30, 2025
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity' Patched CVE-2025-3889 5.3 Jack Taylor April 30, 2025
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference Patched CVE-2025-3874 6.5 Jack Taylor April 30, 2025
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation Patched CVE-2025-3530 7.5 Jack Taylor April 22, 2025
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter Patched CVE-2025-3529 8.2 Jack Taylor April 22, 2025
WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-12622 6.4 Muhammad Yudha - DJ December 23, 2024
WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting Patched CVE-2023-6497 4.4 Webbernaut January 26, 2024
WP Simple Shopping Cart <= 4.6.3 - Information Disclosure Patched CVE-2023-1431 5.3 Ayoub Safa March 16, 2023
WordPress Simple PayPal Shopping Cart <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2022-4672 6.4 István Márton December 27, 2022
WordPress Simple PayPal Shopping Cart < 3.6 - Cross-Site Request Forgery Patched CVE-2013-2705 4.7 August 1, 2014

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation