FoxyShop

FoxyShop has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2022; all 2 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for FoxyShop has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. FoxyShop is installed on roughly 80 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all FoxyShop vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.1CVE-2022-1220

FoxyShop <= 4.8.1 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
FoxyShop banner
Latestv4.9.7
4.5(8)
90/100
Last Updated
2025-03-10 (2y ago)
Active Installs
80+
Downloads
36,786
Requires WP
3.1+
Requires PHP
5.3+
Tested up to
WP 6.7.7
Created
2011-02-20 (16y ago)

FoxyShop is a complete shopping cart solution for WordPress. This plugin connects to FoxyCart’s hosted shopping cart service and will allow you to manage your inventory from a WordPress backend. FoxyShop was built to make the integration of FoxyCart and WordPress a breeze. Products are easy to manage and the flexible templates make it easy for developers to quickly build their storefront. The FoxyShop plugin is exhaustively documented, actively maintained, and completely free. And it’s foxy, too. Visit foxy-shop.com for full documentation and instructions. Just a Few of the Many FoxyShop Features: Fully customizable theme files and CSS Unlimited images per product with popup slideshow or zooming Widget support for featured categories Manage product inventory within the WordPress admin Set up product categories and subcategories Drag-and-drop product sorting Complete flexibility for product variations and pricing Sale pricing with optional date controls Digital products and subscriptions Allow WordPress users to checkout with their account Flexible product and category discounts Multiple shipping recipients Inventory management Internationalization support Field validation to prevent form tampering Much more… See Complete Feature List! Translations Available Norwegian (Kenneth from KKTrends) German (Andrei from PixelDarkroom) Third-party script inclusion As part of this plugin, based on the Foxy store version you have configured, a javascript file will be included from the Foxy CDN to add the cart functionality to your site. The file is unique to your store, and updated based on changes to your store in the Foxy administration. You can exclude this from being output on specific (or all) pages using the “Skip FoxyCart Includes on These Pages” option in the FoxyShop plugin settings. If the file isn’t included on a page with a product add to cart, customers will be redirected to the full page cart instead, and it may impact cart session functionality.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C