Ecwid by Lightspeed Ecommerce Shopping Cart

Vulnerabilities 20Slug ecwid-shopping-cartLatest version 7.0.8WordPress.org →

Minimum safe version

7.0.8

Update to 7.0.8 or later to address 20 fixable vulnerabilities

Latest available7.0.8 ✓

High 8.8

2026-02-15< 7.0.8

Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access

EUVD Wordfence CVE

Medium 5.3

2026-01-23< 7.0.7

CVE-2026-24613

CVE EUVD Wordfence

Medium 4.3

2026-01-23< 7.0.6

CVE-2026-24580

CVE Wordfence

Medium 6.5

2025-04-04< 7.0.1

CVE-2025-32195

CVE Wordfence EUVD

Medium 4.3

2025-02-18< 6.12.28

CVE-2024-13795

CVE EUVD Patchstack Wordfence

N/A

< 6.12.4

Ecwid Ecommerce Shopping Cart < 6.12.4 - Missing Authorization on multiple functions

WPScan

Medium 6.4

2024-04-09< 6.12.11

CVE-2024-2456

CVE Wordfence Patchstack WPScan

Medium 4.3

2024-01-16< 6.12.5

CVE-2023-6292

CVE WPScan

Medium 5.4

2024-12-27< 6.12.5

WordPress Ecwid Shopping Cart Plugin <= 6.12.4 is vulnerable to Cross Site Request Forgery (CSRF)

Patchstack CVE WPScan

N/A

2023-11-28< 6.12.5

Ecwid Ecommerce Shopping Cart <= 6.12.4 - Cross-Site Request Forgery

Wordfence

N/A

2023-11-09< 6.12.4

WordPress Ecwid Shopping Cart Plugin <= 6.12.3 is vulnerable to Broken Access Control

Patchstack

N/A

2023-11-07< 6.12.4

Ecwid Ecommerce Shopping Cart <= 6.12.3 - Missing Authorization on multiple functions

Wordfence

N/A

< 6.10.23

Ecwid Shopping Cart < 6.10.23 - Insufficient Access Control

WPScan

Medium 6.5

2023-05-08< 6.11.5

CVE-2023-24408

CVE Wordfence WPScan

Medium 4.3

2023-02-14< 6.11.4

CVE-2023-24377

CVE Patchstack Wordfence WPScan

N/A

2016-08-08< 4.4.4

Ecwid Ecommerce Shopping Cart <= 4.4.3 - Unauthenticated PHP Object injection

Wordfence

N/A

< 4.4.4

Ecwid Ecommerce Shopping Cart <= 4.4.3 - Unauthenticated PHP Object Injection

WPScan

N/A

2022-07-09< 6.10.23

Ecwid Ecommerce Shopping Cart <= 6.10.22 - Insufficient Access Control on Multiple AJAX Actions

Wordfence

Medium 4.3

2022-09-06< 6.10.24

CVE-2022-2432

CVE Patchstack Wordfence WPScan

N/A

2016-08-08< 4.4.4

WordPress Ecwid Shopping Cart Plugin <= 4.4.3 - Unauthenticated PHP Object Injection

Patchstack