Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
Ecwid by Lightspeed Ecommerce Shopping Cart - Cross-Site Request Forgery (CSRF) (CVE-2026-14332)
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
PLUGIN
Ecwid by Lightspeed Ecommerce Shopping Cart
CVE-2026-14332
Risk Score
Threat Entry
Updated 2026-06-17
Ecwid by Lightspeed Ecommerce Shopping Cart - Privilege Escalation (CVE-2026-1750)
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.
PLUGIN
Ecwid by Lightspeed Ecommerce Shopping Cart
CVE-2026-1750
Risk Score
Threat Entry
Updated 2026-06-17
Ecwid by Lightspeed Ecommerce Shopping Cart - Cross-Site Request Forgery (CSRF) (CVE-2024-13795)
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27. This is due to missing or incorrect nonce validation on the ecwid_deactivate_feedback() function. This makes it possible for unauthenticated attackers to send deactivation messages on behalf of a site owner via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ecwid by Lightspeed Ecommerce Shopping Cart
CVE-2024-13795
Risk Score