WP eCommerce

WP eCommerce has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2011 and 2026; 7 are fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 7.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 3 high. 2014 was the busiest year with 4 disclosures.

The most common weakness is SQL Injection, behind 4 of the records (36%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

7 of the records (64%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2024.

6 independent researchers contributed these findings, most of them (2) reported by DefenceCode.

Strategic Overview

Avg CVSSHigh

7.4/ 10

Patch Coverage64%

Open

Fixed

Get automatic notifications for all WP eCommerce vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2024-1514

WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

11 records


2026-02-13 00:00	eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion WP eCommerce <= 3.15.1	`CVE-2026-1128`	4.3 Medium	Bob Matyas	No
2026-01-21 00:00	eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection WP eCommerce <= 3.15.1	`CVE-2026-1235`	8.1 High	ibrahimsql	No
2024-02-27 00:00	WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection WP eCommerce <= 3.15.1	`CVE-2024-1514`	9.8 Critical	Krzysztof Zając	No
2024-02-27 00:00	WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation WP eCommerce <= 3.15.1	`CVE-2024-1516`	5.3 Medium	Krzysztof Zając	No
2016-11-12 00:00	WP eCommerce < 3.11.4 - SQL Injection WP eCommerce < 3.11.4	`N/A`	8.3 High	Mika Epstein	Yes
2015-04-20 00:00	WP eCommerce <= 3.9.2 - Reflected Cross-Site Scripting WP eCommerce <= 3.9.2	`N/A`	6.1 Medium	Anonymous	Yes
2014-11-01 00:00	WP eCommerce <= 3.8.14.3 - Missing Authorization WP eCommerce <= 3.8.14.3	`N/A`	8.3 High	MICKAEL NADEAU (Sucuri)	Yes
2014-10-05 00:00	WP eCommerce < 3.8.7.6 - SQL Injection WP eCommerce < 3.8.7.6	`CVE-2012-5310`	9.8 Critical	Anonymous	Yes
2014-08-01 00:00	WP eCommerce <= 3.8.9 - Cross-Site Scripting WP eCommerce <= 3.8.9	`N/A`	6.1 Medium	DefenceCode	Yes
2014-08-01 00:00	WP eCommerce <= 3.8.9 - SQL Injection WP eCommerce <= 3.8.9	`N/A`	9.8 Critical	DefenceCode	Yes

Showing 1–10 of 11 reports