Medium severity6.4NVD Advisory· Published May 1, 2025· Updated Jun 17, 2026
CVE-2025-3890
CVE-2025-3890
Description
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:tipsandtricks-hq:wordpress_simple_paypal_shopping_cart:*:*:*:*:*:wordpress:*:*Range: <5.1.4
- Range: <=5.1.3
- mra13/Simple Shopping Cartv5Range: 0
Patches
Vulnerability mechanics
References
4- www.wordfence.com/threat-intel/vulnerabilities/id/93898bf8-cfed-44bf-9d68-a0167beba86anvdThird Party Advisory
- plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/wpsc-shortcodes-related.phpnvdProduct
- plugins.trac.wordpress.org/changeset/3284572/nvdProduct
- www.tipsandtricks-hq.com/ecommerce/simple-wp-shopping-cart-installation-usage-290nvdProduct
News mentions
0No linked articles in our index yet.