Skip to content
PluginCanary

Ecwid by Lightspeed Ecommerce Shopping

Ecwid by Lightspeed Ecommerce Shopping Cart
by Ecwid by Lightspeed Ecommerce Shopping Cart · 20,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 1 Oct 2026, 20 releases in 24 months, no unpatched vulnerabilities.

82/ 100 Canary Score
Sub-scores for Ecwid by Lightspeed Ecommerce Shopping
Ownership100
Maintenance100
Security65
Support70
Reputation70

How the score works

Quick answers

Is Ecwid by Lightspeed Ecommerce Shopping still maintained?
Yes. Last release 1 Oct 2026, 20 releases in the last 24 months. 1 Oct 2026 · wordpress.org
Who owns Ecwid by Lightspeed Ecommerce Shopping, and has it changed hands?
No change recorded. Main committer Ecwid since Oct 2009. 4 Nov 2026 · SVN log
Was Ecwid by Lightspeed Ecommerce Shopping removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Ecwid by Lightspeed Ecommerce Shopping safe?
14 known vulnerabilities, all fixed (latest in 7.0.9). Not on the exploited list. 14 Aug 2026 · Wordfence Intelligence
Is the latest Ecwid by Lightspeed Ecommerce Shopping update safe to install?
No ownership change before 7.0.10. No one-star spike after it. 1 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
Ecwid21 Oct 2009 to 1 Oct 2026, 908 commits

1 committer recorded. No ownership change since 2009.

Maintenance

Last release
34 days ago
Releases, 24 months
20
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Ecwid by Lightspeed Ecommerce Shopping
Q1 20246
Q2 20241
Q3 20246
Q4 20245
Q1 20257
Q2 20253
Q3 20251
Q4 20251
Q1 20263
Q2 20260
Q3 20261
Q4 20261

Last release 1 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.5.

Average rating rose from 4.0 to 5.0 between Q1 2025 and Q2 2025.

Rating distribution
5 star172
4 star28
3 star9
2 star6
1 star13
Latest low reviews

Security record

6 vulnerabilities in 24 months (14 on record), all patched (latest fixed in 7.0.9).

Show 14 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
14 Aug 2026Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Missing Authorization4.3< 7.0.97.0.9Patched before disclosure
14 Feb 2026Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access8.8<= 7.0.77.0.8Patched before disclosure
19 Jan 2026Ecwid Shopping Cart <= 7.0.5 - Missing Authorization4.3<= 7.0.57.0.610
12 Jan 2026Ecwid Shopping Cart <= 7.0.6 - Missing Authorization5.3<= 7.0.67.0.717
4 Apr 2025Ecwid Shopping Cart <= 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 7.07.0.15
17 Feb 2025Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message4.3<= 6.12.276.12.28Patched before disclosure
29 Mar 2024Ecwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 6.12.106.12.11Patched before disclosure
28 Nov 2023Ecwid Ecommerce Shopping Cart <= 6.12.4 - Cross-Site Request Forgery4.3<= 6.12.46.12.5Patched before disclosure
7 Nov 2023Ecwid Ecommerce Shopping Cart <= 6.12.3 - Missing Authorization on multiple functions5.4<= 6.12.36.12.4Patched before disclosure
17 Mar 2023Ecwid Shopping Cart <= 6.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 6.11.46.11.5Patched before disclosure
27 Jan 2023Ecwid Ecommerce Shopping Cart <= 6.11.3 - Cross Site Request Forgery4.3<= 6.11.36.11.4Patched before disclosure
11 Jul 2022Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update8.8<= 6.10.236.10.242
9 Jul 2022Ecwid Ecommerce Shopping Cart <= 6.10.22 - Insufficient Access Control on Multiple AJAX Actions5.4<= 6.10.226.10.231
8 Aug 2016Ecwid Ecommerce Shopping Cart <= 4.4.3 - Unauthenticated PHP Object injection9.8<= 4.4.34.4.41348

Changelog mentions of security fixes: 7.0.9 (security); 7.0.10 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

20,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Ecwid by Lightspeed Ecommerce Shopping
4 May 2026518
11 May 20261,135
18 May 2026872
25 May 2026855
1 Jun 2026841
8 Jun 2026861
15 Jun 2026798
22 Jun 2026747
29 Jun 2026758
6 Jul 2026770
13 Jul 2026762
20 Jul 2026769
27 Jul 2026820
3 Aug 202611,429
10 Aug 20263,683
17 Aug 20261,634
24 Aug 20263,058
31 Aug 20261,519
7 Sep 20261,331
14 Sep 20261,266
21 Sep 20261,451
28 Sep 202611,248
5 Oct 20263,864
12 Oct 20261,913
19 Oct 20261,948
26 Oct 20261,925
2 Nov 2026257

Weekly downloads over the last 4 weeks are 28% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

WooCommerceScore 85 · 7,000,000+Easy Digital DownloadsScore 85 · 40,000+SureCartScore 83 · 80,000+

Facts

Version7.0.10
AuthorEcwid by Lightspeed Ecommerce Shopping Cart
Added21 Oct 2009
Last updated1 Oct 2026
Active installs20,000+
Requires WordPress4.4
Tested up to7.1.4
Requires PHPnot stated
CategoryE-commerce & Shopping
Tagsecommerce, e-commerce, storefront, online store, shopping cart

Other plugins by this author: Protect schema.org markup in HTML editor

Questions

Is Ecwid by Lightspeed Ecommerce Shopping still maintained?

Yes. Last release 1 Oct 2026, 20 releases in the last 24 months.

Who owns Ecwid by Lightspeed Ecommerce Shopping, and has it changed hands?

No change recorded. Main committer Ecwid since Oct 2009.

Was Ecwid by Lightspeed Ecommerce Shopping removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Ecwid by Lightspeed Ecommerce Shopping safe?

14 known vulnerabilities, all fixed (latest in 7.0.9). Not on the exploited list.

Is the latest Ecwid by Lightspeed Ecommerce Shopping update safe to install?

No ownership change before 7.0.10. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue