CVE-2025-3890: WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpcartbutton' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3890?
CVE-2025-3890 is classified as a Stored Cross-Site Scripting vulnerability with a medium severity level.
How do I fix CVE-2025-3890?
To fix CVE-2025-3890, update the WordPress Simple Shopping Cart plugin to version 5.1.4 or later, which includes the necessary input sanitization and output escaping.
What versions are affected by CVE-2025-3890?
CVE-2025-3890 affects all versions of the WordPress Simple Shopping Cart plugin up to and including version 5.1.3.
Can CVE-2025-3890 be exploited remotely?
Yes, CVE-2025-3890 can be exploited remotely if a user has access to the affected shortcode.
What are the potential impacts of exploiting CVE-2025-3890?
Exploiting CVE-2025-3890 can allow attackers to execute arbitrary JavaScript in the context of the user's browser, potentially leading to data theft or session hijacking.