Plugin icon

Ecwid by Lightspeed Ecommerce Shopping Cart

ecwid-shopping-cart

Vulnerabilities:

14

Last Updated:

February 13, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2026-02-14
Title
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.8 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 7.0.8
CVSS
8.8 (high)
Published
2026-01-19
Title
Ecwid Shopping Cart < 7.0.6 - Missing Authorization
Fixed in
Fixed in 7.0.6
CVSS
4.3 (medium)
Published
2026-01-12
Title
Ecwid Shopping Cart < 7.0.7 - Missing Authorization
Fixed in
Fixed in 7.0.7
CVSS
5.3 (medium)
Published
2025-04-04
Title
Ecwid Shopping Cart < 7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 7.0.1
CVSS
6.4 (medium)
Published
2025-02-17
Title
Ecwid by Lightspeed Ecommerce Shopping Cart < 6.12.28 - Cross-Site Request Forgery to Send Deactivation Message
Fixed in
Fixed in 6.12.28
CVSS
4.3 (medium)
Published
2024-03-29
Title
Ecwid Ecommerce Shopping Cart < 6.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 6.12.11
CVSS
6.4 (medium)
Published
2023-11-28
Title
Ecwid Ecommerce Shopping Cart < 6.12.5 - Cross-Site Request Forgery
Fixed in
Fixed in 6.12.5
CVSS
4.3 (medium)
Published
2023-11-21
Title
Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRF
Fixed in
Fixed in 6.12.5
CVSS
4.3 (medium)
Published
2023-11-07
Title
Ecwid Ecommerce Shopping Cart < 6.12.4 - Missing Authorization on multiple functions
Fixed in
Fixed in 6.12.4
CVSS
5.4 (medium)
Published
2023-03-17
Title
Ecwid Shopping Cart < 6.11.5 - Contributor+ Stored Cross-Site Scriping
Fixed in
Fixed in 6.11.5
CVSS
6.8 (medium)
Published
2023-01-27
Title
Ecwid Shopping Cart < 6.11.4 - Import via CSRF
Fixed in
Fixed in 6.11.4
CVSS
4.3 (medium)
Published
2022-08-04
Title
Ecwid Ecommerce Shopping Cart < 6.10.24 - Settings Update via CSRF
Fixed in
Fixed in 6.10.24
CVSS
6.3 (medium)
Published
2022-07-09
Title
Ecwid Shopping Cart < 6.10.23 - Insufficient Access Control
Fixed in
Fixed in 6.10.23
CVSS
5.4 (medium)
Published
2016-08-08
Title
Ecwid Ecommerce Shopping Cart <= 4.4.3 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 4.4.4
CVSS
n/a