https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-3890.htmlhttps://patchthecve.com/cve/CVE-2025-3890.htmlWed, 17 Jun 2026 09:20:52 +0000MEDIUM 6.4: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible https://patchthecve.com/cve/CVE-2025-3889.htmlhttps://patchthecve.com/cve/CVE-2025-3889.htmlWed, 17 Jun 2026 09:20:52 +0000MEDIUM 5.3: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the https://patchthecve.com/cve/CVE-2025-3874.htmlhttps://patchthecve.com/cve/CVE-2025-3874.htmlWed, 17 Jun 2026 09:20:50 +0000MEDIUM 6.5: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit