The Easy Cart WordPress plugin is vulnerable to stored cross‑site scripting in the 'add_to_cart' shortcode. User input provided in attributes such as itemid, product_name, product_desc, product_qty, and price is sanitized with sanitize_text_field, which removes HTML tags but does not escape double‑quote characters. As these values are inserted directly into double‑quoted HTML attributes, an attacker can inject an arbitrary event‑handler attribute (for example, onmouseover="alert(1)") that will execute whenever the affected page is rendered. The vulnerability does not grant privilege escalation; it is limited to authenticated users with Contributor level or higher who can add or edit content that contains the shortcode. When such a user injects a malicious string, browsers will run the contained JavaScript on every visitor of that page, potentially leading to data theft or account takeover on the victim side.

This flaw affects all releases of the Easy Cart plugin from the zeshanb vendor up to and including version 1.8. Any WordPress installation that has the plugin deployed and allows authenticated users with Contributor or higher roles to create or edit content containing the 'add_to_cart' shortcode is vulnerable. No specific operating system or PHP version constraints were cited in the advisory.

The vulnerability has a CVSS score of 6.4, indicating a medium severity. No EPSS score is available, so the exploitation probability is currently unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Contributor or higher user to insert malicious text into a shortcode, and a victim to load a stored page that includes the malicious attribute. Attackers with sufficient privileges can embed scripts that run in the context of site visitors.