Executive brief
The Simple Shopping Cart plugin for WordPress, which allows site owners to sell products and services, contains a security flaw in how it handles product display codes. This vulnerability allows an attacker with basic contributor-level access to embed malicious scripts into website pages. When unsuspecting visitors or administrators view these pages, the scripts could execute, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes within the 'wpsc_display_product' shortcode. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into a post or page. Because the shortcode attributes are not properly neutralized before being rendered, the script is stored on the server and executes in the browser of any user who views the affected content. This vulnerability is present in all versions up to and including 5.2.4; a fix was introduced in subsequent updates.
Affected products
- mra13 Simple Shopping Cart up to, and including, 5.2.4
Timeline
- 2026-04-04: disclosed
- 2026-04-04: advisory