CVE-2025-3529HIGH 8.2EPSS p24.1%

CVE-2025-3529CVE-2025-3529

Description

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.

Scoring

CVSS 3.18.2 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS0.33% probability of exploitation · percentile 24.1% · 2026-06-19T12:03:05Z
Published2025-04-23
Last modified2026-04-15

Underlying weaknesses· 1

CWE-201

References

  1. https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/wpsc-shortcodes-related.php#L92
  2. https://plugins.trac.wordpress.org/changeset/3275373/
  3. https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/#developers
  4. https://www.tipsandtricks-hq.com/ecommerce/wp-simple-cart-sell-digital-downloads-2468
  5. https://www.wordfence.com/threat-intel/vulnerabilities/id/8fecc015-518f-4aab-a17e-17cf4b8cf123?source=cve

1

TypeTargetConfidenceTier
WeaknessInsertion of Sensitive Information Into Sent Datacwe-2010%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-12682
CVE
CVE-2025-4578
CVE
CVE-2025-13329
CVE
CVE-2025-11008
CVE
CVE-2025-7437
CVE
CVE-2025-2558
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.