4.3
Medium
CVE-2023-2896 The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8
Description
The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_duplicate_product function. This makes it possible for unauthenticated attackers to duplicate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Shopping Cart & eCommerce Store 5.4 | earliest → 5.4.8 | No fix stated |
Other CVEs of Shopping Cart & eCommerce Store
The 13 CVEs of Shopping Cart & eCommerce Store →
CVE-2026-17553
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3
7.2
High
CVE-2026-17589
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the…
4.9
Medium
CVE-2024-12712
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a…
5.3
Medium
CVE-2024-7827
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to boolean-based SQL Injection via the…
8.8
High