Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.9 - Stored Cross-Site Scripting via Product Name in Single Product Block and Shortcode
- ID
- WPSEC-2026-0326
- Plugin
- Ecwid by Lightspeed Ecommerce Shopping Cart (ecwid-shopping-cart)
- Affected
- from 6.10.12 before 7.0.10
- Remediation
- Update to 7.0.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Ecwid by Lightspeed Ecommerce Shopping Cart on WPSec AttackSurface
- Fix released
- Published
Description
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the product name in versions 6.10.12 up to, and including, 7.0.9 due to missing output escaping of the product name, taken from the connected Ecwid store's catalog, before it is placed into an HTML attribute by the single product block and the ecwid_product shortcode (version 2 layout). This makes it possible for attackers who can edit product names in the connected Ecwid store, such as Ecwid staff accounts with catalog access, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying that product.
References
- https://wpsec.com/vuln/WPSEC-2026-0326/
- https://plugins.svn.wordpress.org/ecwid-shopping-cart/tags/7.0.10/
- https://wordpress.org/plugins/ecwid-shopping-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS