PT-2026-45707 · Zeshanb · Easycart

Zakaria

·

Published

2026-06-02

·

Updated

2026-06-02

·

CVE-2026-4080

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
The Easy Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add to cart' shortcode in all versions up to and including 1.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the ectp add to cart() function uses sanitize text field() on shortcode attributes like 'itemid', 'product name', 'product desc', 'product qty', and 'price' before inserting them into double-quoted HTML attributes. While sanitize text field() strips HTML tags, it does not escape double quote characters, allowing an attacker to break out of the HTML attribute context and inject arbitrary event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4080

Affected Products

Easycart