WPshop 2 – E-Commerce

Vulnerabilities 10Slug wpshopLatest version 2.6.1WordPress.org →

Minimum safe version

3.4.3.19

Update to 3.4.3.19 or later to address 6 fixable vulnerabilities

Latest available2.6.1 ✗Affected up to2.6.0 ⚠⚠ 2 vulnerabilities have no fix
High 7.5 Unfixed
2026-02-20≤ 2.6.1

CVE-2025-69383

CVEWordfence
Critical 9.8
2025-07-19< 1.3.9.6

CVE-2015-10135

CVEEUVD
Medium 6.5
2025-05-07≥ 2.0.0 and ≤ 2.6.0

WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation

EUVDWordfenceCVE
High 8.8
2025-05-07≥ 2.0.0 and ≤ 2.6.0

WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

EUVDWordfenceCVE
Critical 9.6 Unfixed
2025-04-09≤ 2.6.1

WordPress WP shop plugin <= 2.6.1 - CSRF to Arbitrary File Upload vulnerability

CVEPatchstackWordfenceEUVD
N/A
< 1.3.9.6

Wpshop - eCommerce &lt;= 1.3.9.5 - Arbitrary File Upload

WPScan
N/A
2015-03-09< 1.3.9.6

WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload

Wordfence
N/A
2015-03-09< 1.3.9.6

WordPress WP shop Plugin <= 1.3.9.5 - Arbitrary File Upload

Patchstack
N/A
2015-07-08< 3.4.3.16

WordPress Shop Plugin <= 3.4.3.15 - Blind SQL Injection

Patchstack
N/A
2015-09-17< 3.4.3.19

WordPress Shop Plugin <= 3.4.3.18 - Multiple Vulnerabilities

Patchstack