Plugin security history

Simple Shopping Cart Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 12 vulnerability records associated with Simple Shopping Cart, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

12Total records

0Critical

2High

10Medium

0Low

0Informational

12Patched records

0Currently marked unpatched

2014-08-01First disclosure

2026-06-02Latest disclosure

12 of 12CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2022	1	1 records
2023	1	1 records
2024	2	2 records
2025	5	5 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
High	2	16.7%
Medium	10	83.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

5 records41.7%

First: 2022. Latest: 2026.

Missing Authorization

3 records25%

First: 2025. Latest: 2026.

Information Disclosure

2 records16.7%

First: 2023. Latest: 2025.

CSRF

1 record8.3%

First: 2014. Latest: 2014.

Other

1 record8.3%

First: 2025. Latest: 2025.

Patch Status

Patched: 12
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.3.0
5.2.5
5.1.4
5.1.3
5.0.8
4.7.2
4.6.4
4.6.2
3.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.2.9`	Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference	June 2, 2026	5.3.0	Medium
`*-5.2.4`	Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode	April 3, 2026	5.2.5	Medium
`*-5.1.3`	WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	April 30, 2025	5.1.4	Medium
`*-5.1.3`	WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'	April 30, 2025	5.1.4	Medium
`*-5.1.3`	WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference	April 30, 2025	5.1.4	Medium
`*-5.1.2`	WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation	April 22, 2025	5.1.3	High
`*-5.1.2`	WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter	April 22, 2025	5.1.3	High
`*-5.0.7`	WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 23, 2024	5.0.8	Medium
`*-4.7.1`	WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting	January 26, 2024	4.7.2	Medium
`4.6.3`	WP Simple Shopping Cart <= 4.6.3 - Information Disclosure	March 16, 2023	4.6.4	Medium
`*-4.6.1`	WordPress Simple PayPal Shopping Cart <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	December 27, 2022	4.6.2	Medium
`[*, 3.6)`	WordPress Simple PayPal Shopping Cart < 3.6 - Cross-Site Request Forgery	August 1, 2014	3.6	Medium

Selected source records

Latest Records

MediumCVE-2026-48868

Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference

Published: June 2, 2026

Affected versions: *-5.2.9
Patched versions: 5.3.0

Original Wordfence record

MediumCVE-2026-0552

Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode

Published: April 3, 2026

Affected versions: *-5.2.4
Patched versions: 5.2.5

Original Wordfence record

MediumCVE-2025-3890

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: April 30, 2025

Affected versions: *-5.1.3
Patched versions: 5.1.4

Original Wordfence record

MediumCVE-2025-3889

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'

Published: April 30, 2025

Affected versions: *-5.1.3
Patched versions: 5.1.4

Original Wordfence record

MediumCVE-2025-3874

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference

Published: April 30, 2025

Affected versions: *-5.1.3
Patched versions: 5.1.4

Original Wordfence record

HighCVE-2025-3530

WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation

Published: April 22, 2025

Affected versions: *-5.1.2
Patched versions: 5.1.3

Original Wordfence record

HighCVE-2025-3529

WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter

Published: April 22, 2025

Affected versions: *-5.1.2
Patched versions: 5.1.3

Original Wordfence record

MediumCVE-2024-12622

WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 23, 2024

Affected versions: *-5.0.7
Patched versions: 5.0.8

Original Wordfence record

Highest-Severity Records

HighCVE-2025-3529

WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter

Published: April 22, 2025

Affected versions: *-5.1.2
Patched versions: 5.1.3

Original Wordfence record

HighCVE-2025-3530

WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation

Published: April 22, 2025

Affected versions: *-5.1.2
Patched versions: 5.1.3

Original Wordfence record

MediumCVE-2025-3874

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference

Published: April 30, 2025

Affected versions: *-5.1.3
Patched versions: 5.1.4

Original Wordfence record

MediumCVE-2022-4672

WordPress Simple PayPal Shopping Cart <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: December 27, 2022

Affected versions: *-4.6.1
Patched versions: 4.6.2

Original Wordfence record

MediumCVE-2025-3890

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: April 30, 2025

Affected versions: *-5.1.3
Patched versions: 5.1.4

Original Wordfence record

MediumCVE-2026-0552

Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode

Published: April 3, 2026

Affected versions: *-5.2.4
Patched versions: 5.2.5

Original Wordfence record

MediumCVE-2024-12622

WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 23, 2024

Affected versions: *-5.0.7
Patched versions: 5.0.8

Original Wordfence record

MediumCVE-2025-3889

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'

Published: April 30, 2025

Affected versions: *-5.1.3
Patched versions: 5.1.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory