Eoxia Wpshop 2 E-Commerce vulnerabilities

CVE-2015-10135 [CRITICAL] CWE-434 CVE-2015-10135: The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missin The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVE-2025-3852 [HIGH] CWE-269 CVE-2025-3852: The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account tak The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-

CVE-2025-3853 [MEDIUM] CWE-639 CVE-2025-3853: The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.