High severity · published Apr 23, 2025
CVE-2025-3529
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Simple Shopping Cart · mra13
through 5.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3529
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/wpsc-shortcodes-related.php#L92
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3275373/
wordpress.org
https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/#developers
www.tipsandtricks-hq.com
https://www.tipsandtricks-hq.com/ecommerce/wp-simple-cart-sell-digital-downloads-2468
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/8fecc015-518f-4aab-a17e-17cf4b8cf123?source=cve
More from Simple Shopping Cart
7.5
CVE-2025-3530
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation
6.5
CVE-2025-3874
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference
6.4
CVE-2026-0552
Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode
6.4
CVE-2024-12622
WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
5.4
CVE-2025-3890
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode