Stored Cross-Site Scripting in Easy Cart Plugin for WordPress

CVE-2026-4080

What is CVE-2026-4080?

The Easy Cart plugin for WordPress presents a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate sanitization of user inputs associated with the 'add_to_cart' shortcode. Specifically, the ectp_add_to_cart() function utilizes sanitize_text_field() on shortcode attributes such as 'itemid', 'product_name', 'product_desc', 'product_qty', and 'price'. Although this function removes HTML tags, it fails to escape double quote characters, permitting attackers with Contributor-level access or higher to inject malicious scripts into HTML attributes. This vulnerability can lead to the execution of arbitrary scripts in the context of an authenticated user's browsing session, thus compromising the security of affected WordPress sites.

References