Vulnerability in Mra13 Simple Shopping Cart
CVE-2025-3529
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view…
EPSS: 0.003 (55.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Mra13 Simple Shopping Cart — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.wordfence.com/threat-intel/vulnerabilities/id/8fecc015-518f-4aab-a17e-17cf4…
- plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5…
- www.tipsandtricks-hq.com/ecommerce/wp-simple-cart-sell-digital-downloads-2468
- wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/
- plugins.trac.wordpress.org/changeset/3275373/
Frequently asked questions
- What is CVE-2025-3529?
- CVE-2025-3529 is a high-severity vulnerability in Mra13 Simple Shopping Cart, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 8.2/10. Published 2025-04-23.
- How severe is CVE-2025-3529?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2025-3529 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.