Wpshop 2 – E Commerce
Approved changes feed: RSS · Atom
cpe:2.3:a:eoxia:wpshop_2_–_e-commerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Eoxia (9391f2b1-8bae-56c9-9273-b4c3923ae6d8) |
|---|---|
| Product | Wpshop 2 – E Commerce (a69fb158-bf46-5e2a-9eb8-6964954f2e7d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-3853 |
vulnerable | 2026-06-08 07:23:10.025611 |
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation
MEDIUM (6.5)
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
Published: 2025-05-07T01:43:06.033Z
Updated: 2025-05-07T14:03:41.938Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3852 |
vulnerable | 2026-06-08 07:23:10.025170 |
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
HIGH (8.8)
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Published: 2025-05-07T01:43:08.509Z
Updated: 2025-05-07T14:03:07.017Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-10135 |
vulnerable | 2026-06-08 05:06:24.755344 |
WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload
CRITICAL (9.8)
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Published: 2025-07-19T09:23:52.009Z
Updated: 2026-04-08T16:45:25.836Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.