Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Ecwid Shopping Cart - Privilege Escalation (CVE-2026-1750)
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.
PLUGIN
Ecwid Shopping Cart
CVE-2026-1750
Risk Score
Threat Entry
Updated 2026-06-17
Ecwid Shopping Cart - Broken Access Control (CVE-2026-24613)
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through
PLUGIN
Ecwid Shopping Cart
CVE-2026-24613
Risk Score
Threat Entry
Updated 2026-06-17
Ecwid Shopping Cart - Broken Access Control (CVE-2026-24580)
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through
PLUGIN
Ecwid Shopping Cart
CVE-2026-24580
Risk Score
Threat Entry
Updated 2026-06-17
Ecwid Shopping Cart - Cross-Site Scripting (XSS) (CVE-2025-32195)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Stored XSS.This issue affects Ecwid Shopping Cart: from n/a through
PLUGIN
Ecwid Shopping Cart
CVE-2025-32195
Risk Score