WordPress wp-easycart has 12 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2014-9308 | Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart | medium | 6.5 | <=3.0.8 | – |
| CVE-2015-2673 | The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 th | high | 8.8 | =1.1.30 or =1.1.31 or =1.1.32 or =1.1.33 or =1.1.34 or =1.1.35 or =1.1.36 or =1.2.0 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.2.6 or =1.2.7 or =1.2.8 or =1.2.9 or =1.2.10 or =1.2.11 or =1.2.12 or =1.2.13 or =1.2.14 or =1.2.15 or =1.2.16 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.0.12 or =2.0.13 or =2.0.14 or =2.0.15 or =2.0.16 or =2.0.17 or =2.0.18 or =2.0.19 or =2.0.20 or =2.0.21 or =2.0.22 or =2.1.0 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.4 or =2.1.5 or =2.1.6 or =2.1.7 or =2.1.8 or =2.1.9 or =2.1.10 or =2.1.11 or =2.1.12 or =2.1.13 or =2.1.14 or =2.1.15 or =2.1.16 or =2.1.17 or =2.1.18 or =2.1.19 or =2.1.20 or =2.1.21 or =2.1.22 or =2.1.23 or =2.1.24 or =2.1.25 or =2.1.26 or =2.1.27 or =2.1.28 or =2.1.29 or =2.1.30 or =2.1.31 or =2.1.32 or =2.1.33 or =2.1.34 or =2.1.35 or =2.1.36 or =3.0.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.0.7 or =3.0.8 or =3.0.9 or =3.0.10 or =3.0.11 or =3.0.12 or =3.0.13 or =3.0.14 or =3.0.15 or =3.0.16 or =3.0.17 or =3.0.18 or =3.0.19 or =3.0.20 | – |
| CVE-2014-4942 | The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct reques | medium | 5.0 | <=2.0.5 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 | – |
| CVE-2023-1124 | The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin p | high | 7.2 | <5.4.3 | 5.4.3 |
| CVE-2023-3023 | The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, | high | 7.2 | <5.4.11 | 5.4.11 |
| CVE-2021-34645 | The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function fou | high | 8.8 | <=5.1.0 | – |
| CVE-2023-2891 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | <=5.4.8 | – |
| CVE-2023-2893 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | <=5.4.8 | – |
| CVE-2023-2894 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | <=5.4.8 | – |
| CVE-2023-2895 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | <=5.4.8 | – |
| CVE-2023-2896 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 4.3 | <=5.4.8 | – |
| CVE-2023-2892 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis | medium | 6.5 | <=5.4.8 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked