Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsc_display_product' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-04 | 1 | Disclosure1 |
| 2026-04-10 | 1 | PoC1 |
CVE-2026-0552 The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsc_display_product' shortcode in all versions up to, and … https://www.cve.org/CVERecord?id=CVE-2026-0552
Post summary
The passage announces a stored XSS flaw in WordPress's Simple Shopping Cart plugin, describing the affected component and vector, but offers no PoC, exploit code, or patch information.
https://atomicedge.io/cve-proof/cve-2026-0552-wordpress-simple-paypal-shopping-cart-version-5-2-4-medium-vulnerability-proof-of-concept CVE-2026-0552 #WordPress plugin #vulnerability wordpress-simple-paypal-shopping-cart #cybersecurity #wordpressfirewall #wordpresssecurity #ha…
Post summary
The post shares a proof‑of‑concept for CVE‑2026‑0552 affecting WordPress Simple PayPal Shopping Cart v5.2.4, with no indication of active exploitation or patch availability.