WordPress security by component
WP eCommerce
Plugin description
WP eCommerce is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Mar 06, 2026; the highest CVE/CNA score is 6.5.
Plugin slug:
wp-ecommerceLatest vulnerability
CVE-2026-1128: WP eCommerce: Cross-site request forgery
WP eCommerce is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
| Safe version |
|
||
|---|---|---|---|
| Mar 06, 2026 |
CVE-2026-1128
WP eCommerce: Cross-site request forgery
WP eCommerce is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Feb 11, 2026 |
CVE-2026-1235
WP eCommerce: Code execution
WP eCommerce is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE6.5
NVDPending
|