Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?WP shopwpshopgermany-it-recht-kanzleiShopWPwpshopgermany-protectedshops
Plugin · wpshop
WP shop
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Feb 20, 2026WP shop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69383 · affects up to 2.6.1 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows PHP Local File Inclusion.This issue affects WP shop: from n/a through <= 2.6.1.
Jul 19, 2025WPshop 2 – E-Commerce: Arbitrary file uploadsCVE-2015-10135 · fixed in 1.3.9.6 · reported by WordfenceCritical 9.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
May 6, 2025WPshop 2 – E-Commerce: Insecure Direct Object ReferenceCVE-2025-3853 · affects 2.0.0 to 2.6.0 · reported by WordfenceMedium 6.5
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
May 6, 2025WPshop 2 – E-Commerce: Privilege escalationCVE-2025-3852 · affects 2.0.0 to 2.6.0 · reported by WordfenceHigh 8.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2025WP shop: Cross-Site Request Forgery (CSRF)CVE-2025-32576 · affects up to 2.6.1 · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web Shell to a Web Server.This issue affects WP shop: from n/a through <= 2.6.1.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.