CVE-2025-62997
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The WP EasyCart plugin from levelfourdevelopment is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 5.8.11.
Risk Assessment
An attacker can access sensitive data that is being sent, potentially leading to confidentiality breaches and information leakage.
Recommendation
Update the WP EasyCart plugin to the latest patched version. Also check for any data leaks.
Other vulnerabilities in WP EasyCart
See all- CVE-2026-94124High
Contributor SQL Injection in WP EasyCart versions up to 5.9.4.
- CVE-2026-17553High
The WP EasyCart plugin for WordPress up to version 5.9.3 is vulnerable to privilege escalation. The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly to update_option() without an allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This allows authenticated attackers with Store Manager-level access and above to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.
- CVE-2026-57765High
The WP EasyCart plugin for WordPress versions 5.9.0 and earlier contains a SQL injection vulnerability via the 'contributor' attribute. This allows an attacker to manipulate database queries.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Retrieve Embedded Sensitive Data.This issue affects WP EasyCart: from n/a through <= 5.8.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS