Known vulnerabilities in Shopping Cart & eCommerce Store

A FREE WordPress eCommerce & WordPress Shopping Cart plugin that can sell products, subscriptions, downloads, services, donations, and much more o …

24Reported vulnerabilities

8.8Highest CVSS score

5.9.2Latest version

3,000+Active installs

What to do now

Update Shopping Cart & eCommerce Store to 5.9.3 or later. 24 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 2, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2014-9308	Medium 6.5	50.6%	3.0.8 and earlier	`3.0.16`	January 15, 2015
CVE-2015-2673	High 8.8	18.9%	1.1.30 to 1.1.30 (inclusive) 1.1.31 to 1.1.31 (inclusive) 1.1.32 to 1.1.32 (inclusive) 1.1.33 to 1.1.33 (inclusive) 1.1.34 to 1.1.34 (inclusive) 1.1.35 to 1.1.35 (inclusive) 1.1.36 to 1.1.36 (inclusive) 1.2.0 to 1.2.0 (inclusive) 1.2.1 to 1.2.1 (inclusive) 1.2.2 to 1.2.2 (inclusive) 1.2.3 to 1.2.3 (inclusive) 1.2.4 to 1.2.4 (inclusive) 1.2.5 to 1.2.5 (inclusive) 1.2.6 to 1.2.6 (inclusive) 1.2.7 to 1.2.7 (inclusive) 1.2.8 to 1.2.8 (inclusive) 1.2.9 to 1.2.9 (inclusive) 1.2.10 to 1.2.10 (inclusive) 1.2.11 to 1.2.11 (inclusive) 1.2.12 to 1.2.12 (inclusive) 1.2.13 to 1.2.13 (inclusive) 1.2.14 to 1.2.14 (inclusive) 1.2.15 to 1.2.15 (inclusive) 1.2.16 to 1.2.16 (inclusive) 2.0.1 to 2.0.1 (inclusive) 2.0.1@824267 to 2.0.1@824267 (inclusive) 2.0.2 to 2.0.2 (inclusive) 2.0.3 to 2.0.3 (inclusive) 2.0.4 to 2.0.4 (inclusive) 2.0.5 to 2.0.5 (inclusive) 2.0.6 to 2.0.6 (inclusive) 2.0.7 to 2.0.7 (inclusive) 2.0.8 to 2.0.8 (inclusive) 2.0.9 to 2.0.9 (inclusive) 2.0.10 to 2.0.10 (inclusive) 2.0.11 to 2.0.11 (inclusive) 2.0.12 to 2.0.12 (inclusive) 2.0.13 to 2.0.13 (inclusive) 2.0.14 to 2.0.14 (inclusive) 2.0.15 to 2.0.15 (inclusive) 2.0.16 to 2.0.16 (inclusive) 2.0.17 to 2.0.17 (inclusive) 2.0.18 to 2.0.18 (inclusive) 2.0.19 to 2.0.19 (inclusive) 2.0.20 to 2.0.20 (inclusive) 2.0.21 to 2.0.21 (inclusive) 2.0.22 to 2.0.22 (inclusive) 2.1.0 to 2.1.0 (inclusive) 2.1.1 to 2.1.1 (inclusive) 2.1.2 to 2.1.2 (inclusive) 2.1.3 to 2.1.3 (inclusive) 2.1.4 to 2.1.4 (inclusive) 2.1.5 to 2.1.5 (inclusive) 2.1.6 to 2.1.6 (inclusive) 2.1.7 to 2.1.7 (inclusive) 2.1.8 to 2.1.8 (inclusive) 2.1.9 to 2.1.9 (inclusive) 2.1.10 to 2.1.10 (inclusive) 2.1.11 to 2.1.11 (inclusive) 2.1.12 to 2.1.12 (inclusive) 2.1.13 to 2.1.13 (inclusive) 2.1.14 to 2.1.14 (inclusive) 2.1.15 to 2.1.15 (inclusive) 2.1.16 to 2.1.16 (inclusive) 2.1.17 to 2.1.17 (inclusive) 2.1.18 to 2.1.18 (inclusive) 2.1.19 to 2.1.19 (inclusive) 2.1.20 to 2.1.20 (inclusive) 2.1.21 to 2.1.21 (inclusive) 2.1.22 to 2.1.22 (inclusive) 2.1.23 to 2.1.23 (inclusive) 2.1.24 to 2.1.24 (inclusive) 2.1.25 to 2.1.25 (inclusive) 2.1.26 to 2.1.26 (inclusive) 2.1.27 to 2.1.27 (inclusive) 2.1.28 to 2.1.28 (inclusive) 2.1.29 to 2.1.29 (inclusive) 2.1.30 to 2.1.30 (inclusive) 2.1.31 to 2.1.31 (inclusive) 2.1.32 to 2.1.32 (inclusive) 2.1.33 to 2.1.33 (inclusive) 2.1.34 to 2.1.34 (inclusive) 2.1.35 to 2.1.35 (inclusive) 2.1.36 to 2.1.36 (inclusive) 3.0.0 to 3.0.0 (inclusive) 3.0.1 to 3.0.1 (inclusive) 3.0.2 to 3.0.2 (inclusive) 3.0.3 to 3.0.3 (inclusive) 3.0.4 to 3.0.4 (inclusive) 3.0.5 to 3.0.5 (inclusive) 3.0.6 to 3.0.6 (inclusive) 3.0.7 to 3.0.7 (inclusive) 3.0.8 to 3.0.8 (inclusive) 3.0.9 to 3.0.9 (inclusive) 3.0.10 to 3.0.10 (inclusive) 3.0.11 to 3.0.11 (inclusive) 3.0.12 to 3.0.12 (inclusive) 3.0.13 to 3.0.13 (inclusive) 3.0.14 to 3.0.14 (inclusive) 3.0.15 to 3.0.15 (inclusive) 3.0.16 to 3.0.16 (inclusive) 3.0.17 to 3.0.17 (inclusive) 3.0.18 to 3.0.18 (inclusive) 3.0.19 to 3.0.19 (inclusive) 3.0.20 to 3.0.20 (inclusive)	`3.0.21`	October 6, 2017
CVE-2023-1124	High 7.2	1.1%	Before 5.4.3	`5.4.3`	April 3, 2023
CVE-2014-4942	Medium 5	4.5%	2.0.5 and earlier 2.0.1 to 2.0.1 (inclusive) 2.0.2 to 2.0.2 (inclusive) 2.0.3 to 2.0.3 (inclusive) 2.0.4 to 2.0.4 (inclusive)	`2.0.6`	July 11, 2014
CVE-2024-7827	High 8.8	0.5%	0 to 5.7.2 (inclusive) 0 to 5.7.2 (inclusive)	`5.7.3`	August 20, 2024
CVE-2024-3211	High 8.8	0.6%	0 to 5.6.3 (inclusive) 0 to 5.6.3 (inclusive)	`5.6.4`	April 12, 2024
CVE-2021-34645	High 8.8	0.6%	5.1.0 and earlier	`5.1.5`	August 19, 2021
CVE-2023-3023	High 7.2	0.7%	Before 5.4.11	`5.4.11`	July 12, 2023
CVE-2026-57765	Medium 6.5	0.4%	5.9.1 and earlier	`5.9.2`	July 2, 2026
CVE-2026-32422	Medium 6.5	0.2%	5.8.13 and earlier	`5.8.14`	February 27, 2026
WF-46258dc2-3e05-4050-baad-3b3ded912bfe	Medium 6.5	—	5.2.4 and earlier	`5.2.5`	March 28, 2022
WF-6ebc1b85-4682-4467-b17c-9a35cc3f0f15	Medium 6.3	—	5.2.6 and earlier	`5.3.0`	April 15, 2022
CVE-2025-62997	Medium 5.3	0.3%	5.8.11 and earlier	`5.8.12`	December 8, 2025
CVE-2024-12712	Medium 5.3	0.3%	0 to 5.7.8 (inclusive)	`5.7.9`	January 8, 2025
CVE-2024-35667	Medium 5.3	0.4%	5.5.19 and earlier	`5.6.0`	June 3, 2024
CVE-2024-4213	Medium 5.3	0.5%	0 to 5.6.4 (inclusive) 0 to 5.6.4 (inclusive)	`5.6.5`	May 14, 2024
CVE-2026-17589	Medium 4.9	0.3%	0 to 5.9.2 (inclusive)	`5.9.3`	September 1, 2026
CVE-2024-32452	Medium 4.3	0.2%	5.5.19 and earlier	`5.6.0`	April 12, 2024
CVE-2023-2896	Medium 4.3	0.2%	5.4.8 and earlier	`5.4.9`	June 9, 2023
CVE-2023-2895	Medium 4.3	0.2%	5.4.8 and earlier	`5.4.9`	June 9, 2023
CVE-2023-2894	Medium 4.3	0.2%	5.4.8 and earlier	`5.4.9`	June 9, 2023
CVE-2023-2893	Medium 4.3	0.2%	5.4.8 and earlier	`5.4.9`	June 9, 2023
CVE-2023-2892	Medium 4.3	0.2%	5.4.8 and earlier	`5.4.9`	June 9, 2023
CVE-2023-2891	Medium 4.3	0.2%	5.4.8 and earlier	`5.4.9`	June 9, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.