Simple Shopping Cart vulnerabilities

Versions of Simple Shopping Cart <= 5.2.9 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.

Stored Cross-Site Scripting (XSS) vulnerability in WordPress Simple Shopping Cart plugin up to version 5.2.4. Through the 'wpsc_display_product' shortcode and user-supplied attributes, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.

A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in some unknown processing of the file /Admin/additems.php. Manipulation of the argument item_name leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.

A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in unknown code of the file /Customers/settings.php. Manipulation of the argument user_id results in SQL injection. Remote exploitation is possible and the exploit has been made public.