FoxyShop
FoxyShop has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2022; all 2 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for FoxyShop has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. FoxyShop is installed on roughly 80 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2022-1220FoxyShop <= 4.8.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

FoxyShop
Author
sparkweb
FoxyShop is a complete shopping cart solution for WordPress. This plugin connects to FoxyCart’s hosted shopping cart service and will allow you to manage your inventory from a WordPress backend. FoxyShop was built to make the integration of FoxyCart and WordPress a breeze. Products are easy to manage and the flexible templates make it easy for developers to quickly build their storefront. The FoxyShop plugin is exhaustively documented, actively maintained, and completely free. And it’s foxy, too. Visit foxy-shop.com for full documentation and instructions. Just a Few of the Many FoxyShop Features: Fully customizable theme files and CSS Unlimited images per product with popup slideshow or zooming Widget support for featured categories Manage product inventory within the WordPress admin Set up product categories and subcategories Drag-and-drop product sorting Complete flexibility for product variations and pricing Sale pricing with optional date controls Digital products and subscriptions Allow WordPress users to checkout with their account Flexible product and category discounts Multiple shipping recipients Inventory management Internationalization support Field validation to prevent form tampering Much more… See Complete Feature List! Translations Available Norwegian (Kenneth from KKTrends) German (Andrei from PixelDarkroom) Third-party script inclusion As part of this plugin, based on the Foxy store version you have configured, a javascript file will be included from the Foxy CDN to add the cart functionality to your site. The file is unique to your store, and updated based on changes to your store in the Foxy administration. You can exclude this from being output on specific (or all) pages using the “Skip FoxyCart Includes on These Pages” option in the FoxyShop plugin settings. If the file isn’t included on a page with a product add to cart, customers will be redirected to the full page cart instead, and it may impact cart session functionality.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C