Plugin security history

WP eCommerce Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 11 vulnerability records associated with WP eCommerce, published between 2011 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

11Total records

3Critical

3High

5Medium

0Low

0Informational

7Patched records

4Currently marked unpatched

2011-11-21First disclosure

2026-02-13Latest disclosure

6 of 11CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2011	1	1 records
2014	4	4 records
2015	1	1 records
2016	1	1 records
2024	2	2 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	3	27.3%
High	3	27.3%
Medium	5	45.5%

Vulnerability-Type Breakdown

SQL Injection

4 records36.4%

First: 2014. Latest: 2024.

Cross-Site Scripting

3 records27.3%

First: 2011. Latest: 2015.

Missing Authorization

2 records18.2%

First: 2014. Latest: 2024.

Other

1 record9.1%

First: 2026. Latest: 2026.

CSRF

1 record9.1%

First: 2026. Latest: 2026.

Patch Status

Patched: 7
Currently marked unpatched: 4
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.11.4
3.9.3
3.8.14.4
3.8.7.6
3.8.9.1
3.8.7.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.15.1`	eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion	February 13, 2026	Not supplied	Medium
`*-3.15.1`	eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection	January 21, 2026	Not supplied	High
`*-3.15.1`	WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation	February 27, 2024	Not supplied	Medium
`*-3.15.1`	WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection	February 27, 2024	Not supplied	Critical
`[*, 3.11.4)`	WP eCommerce < 3.11.4 - SQL Injection	November 12, 2016	3.11.4	High
`*-3.9.2`	WP eCommerce <= 3.9.2 - Reflected Cross-Site Scripting	April 20, 2015	3.9.3	Medium
`*-3.8.14.3`	WP eCommerce <= 3.8.14.3 - Missing Authorization	November 1, 2014	3.8.14.4	High
`[*, 3.8.7.6)`	WP eCommerce < 3.8.7.6 - SQL Injection	October 5, 2014	3.8.7.6	Critical
`*-3.8.9`	WP eCommerce <= 3.8.9 - SQL Injection	August 1, 2014	3.8.9.1	Critical
`*-3.8.9`	WP eCommerce <= 3.8.9 - Cross-Site Scripting	August 1, 2014	3.8.9.1	Medium
`[*, 3.8.7.2)`	WP eCommerce < 3.8.7.2 - Stored Cross-Site Scripting	November 21, 2011	3.8.7.2	Medium

Selected source records

Latest Records

MediumCVE-2026-1128

eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion

Published: February 13, 2026

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

HighCVE-2026-1235

eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection

Published: January 21, 2026

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2024-1514

WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection

Published: February 27, 2024

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-1516

WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation

Published: February 27, 2024

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

High

WP eCommerce < 3.11.4 - SQL Injection

Published: November 12, 2016

Affected versions: [*, 3.11.4)
Patched versions: 3.11.4

Original Wordfence record

Medium

WP eCommerce <= 3.9.2 - Reflected Cross-Site Scripting

Published: April 20, 2015

Affected versions: *-3.9.2
Patched versions: 3.9.3

Original Wordfence record

High

WP eCommerce <= 3.8.14.3 - Missing Authorization

Published: November 1, 2014

Affected versions: *-3.8.14.3
Patched versions: 3.8.14.4

Original Wordfence record

CriticalCVE-2012-5310

WP eCommerce < 3.8.7.6 - SQL Injection

Published: October 5, 2014

Affected versions: [*, 3.8.7.6)
Patched versions: 3.8.7.6

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-1514

WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection

Published: February 27, 2024

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2012-5310

WP eCommerce < 3.8.7.6 - SQL Injection

Published: October 5, 2014

Affected versions: [*, 3.8.7.6)
Patched versions: 3.8.7.6

Original Wordfence record

Critical

WP eCommerce <= 3.8.9 - SQL Injection

Published: August 1, 2014

Affected versions: *-3.8.9
Patched versions: 3.8.9.1

Original Wordfence record

High

WP eCommerce < 3.11.4 - SQL Injection

Published: November 12, 2016

Affected versions: [*, 3.11.4)
Patched versions: 3.11.4

Original Wordfence record

High

WP eCommerce <= 3.8.14.3 - Missing Authorization

Published: November 1, 2014

Affected versions: *-3.8.14.3
Patched versions: 3.8.14.4

Original Wordfence record

HighCVE-2026-1235

eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection

Published: January 21, 2026

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

Medium

WP eCommerce <= 3.8.9 - Cross-Site Scripting

Published: August 1, 2014

Affected versions: *-3.8.9
Patched versions: 3.8.9.1

Original Wordfence record

Medium

WP eCommerce <= 3.9.2 - Reflected Cross-Site Scripting

Published: April 20, 2015

Affected versions: *-3.9.2
Patched versions: 3.9.3

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2026-1128

eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion

Published: February 13, 2026

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

HighCVE-2026-1235

eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection

Published: January 21, 2026

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2024-1514

WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection

Published: February 27, 2024

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-1516

WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation

Published: February 27, 2024

Affected versions: *-3.15.1
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory