Skip to content
PluginCanary

WP EasyCart

WP EasyCart: Shopping Cart and eCommerce Store
by levelfourdevelopment · 3,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 29 Oct 2026, 67 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for WP EasyCart
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is WP EasyCart still maintained?
Yes. Last release 29 Oct 2026, 67 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns WP EasyCart, and has it changed hands?
No change recorded. Main committer levelfourstorefront since Jul 2013. 3 Nov 2026 · SVN log
Was WP EasyCart removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WP EasyCart safe?
26 known vulnerabilities, all fixed (latest in 6.0.0). Not on the exploited list. 23 Sep 2026 · Wordfence Intelligence
Is the latest WP EasyCart update safe to install?
No ownership change before 6.0.6. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
levelfourstorefront16 Jul 2013 to 29 Oct 2026, 1470 commits

1 committer recorded. No ownership change since 2013.

Maintenance

Last release
5 days ago
Releases, 24 months
67
Tested up to
7.1 current
Requires PHP
7.3 supported 8.2+
Releases per quarter
Releases per quarter for WP EasyCart
Q1 20245
Q2 20246
Q3 20244
Q4 20245
Q1 20254
Q2 20257
Q3 20255
Q4 20252
Q1 20262
Q2 20264
Q3 20266
Q4 202633

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.5.

Rating distribution
5 star168
4 star11
3 star5
2 star2
1 star20

Security record

7 vulnerabilities in 24 months (26 on record), all patched (latest fixed in 6.0.0).

Show 26 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
23 Sep 2026Shopping Cart & eCommerce Store <= 5.9.4 - Authenticated (Contributor+) SQL Injection6.5<= 5.9.46.0.0Patched before disclosure
8 Sep 2026Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action7.2<= 5.9.35.9.4Patched before disclosure
31 Aug 2026Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter4.9<= 5.9.25.9.3Patched before disclosure
2 Jul 2026Shopping Cart & eCommerce Store <= 5.9.1 - Authenticated (Contributor+) SQL Injection6.5<= 5.9.15.9.232
27 Feb 2026EasyCart <= 5.8.13 - Authenticated (Contributor+) SQL Injection6.5<= 5.8.135.8.14Patched before disclosure
8 Dec 2025EasyCart <= 5.8.11 - Unauthenticated Information Exposure5.3<= 5.8.115.8.1212
7 Jan 2025Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates5.3<= 5.7.85.7.9Patched before disclosure
19 Aug 2024Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter8.8<= 5.7.25.7.3Patched before disclosure
3 Jun 2024WP EasyCart <= 5.5.19 - Missing Authorization5.3<= 5.5.195.6.0Patched before disclosure
10 May 2024Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure5.3<= 5.6.45.6.5Patched before disclosure
12 Apr 2024WP EasyCart <= 5.5.19 - Cross-Site Request Forgery4.3<= 5.5.195.6.0Patched before disclosure
11 Apr 2024Shopping Cart & eCommerce Store <= 5.6.3 - Authenticated (Contributor+) SQL Injection8.8<= 5.6.35.6.4Patched before disclosure
8 Jun 2023WP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'7.2<= 5.4.105.4.111
27 May 2023WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_deactivate_product4.3<= 5.4.85.4.9Patched before disclosure
27 May 2023WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_duplicate_product4.3<= 5.4.85.4.9Patched before disclosure
27 May 2023WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_deactivate_product4.3<= 5.4.85.4.9Patched before disclosure
27 May 2023WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product6.5<= 5.4.85.4.9Patched before disclosure
27 May 2023WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_activate_product4.3<= 5.4.85.4.9Patched before disclosure
27 May 2023WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product6.5<= 5.4.85.4.9Patched before disclosure
13 Mar 2023Shopping Cart & eCommerce Store <= 5.4.2 - Authenticated (Admin+) Local File Inclusion via import_file_url7.2<= 5.4.25.4.3Patched before disclosure
15 Apr 2022Shopping Cart & eCommerce Store <= 5.2.6 - Cross-Site Request Forgery6.3<= 5.2.65.3.01
28 Mar 2022Shopping Cart & eCommerce Store <= 5.2.4 - Cross-Site Request Forgery to Settings Update6.5<= 5.2.45.2.5Patched before disclosure
18 Aug 2021Shopping Cart & eCommerce Store <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting8.8<= 5.1.05.1.517
26 Feb 2015EasyCart 1.1.30 - 3.0.20 - Privilege Escalation8.81.1.30 to 3.0.203.0.21943
9 Jan 2015Shopping Cart & eCommerce Store < 3.0.16 - Arbitrary File Upload8.8< 3.0.163.0.16991

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

3,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP EasyCart
4 May 2026283
11 May 2026276
18 May 20262,709
25 May 2026752
1 Jun 20263,049
8 Jun 20262,882
15 Jun 2026730
22 Jun 2026378
29 Jun 2026430
6 Jul 20263,137
13 Jul 2026441
20 Jul 2026385
27 Jul 2026423
3 Aug 20263,422
10 Aug 2026451
17 Aug 20262,724
24 Aug 2026737
31 Aug 20262,998
7 Sep 2026812
14 Sep 20263,069
21 Sep 20263,356
28 Sep 20263,162
5 Oct 20263,663
12 Oct 20263,215
19 Oct 20263,337
26 Oct 20263,492
2 Nov 2026171

Weekly downloads over the last 4 weeks are 37% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

WooCommerceScore 85 · 7,000,000+Easy Digital DownloadsScore 85 · 40,000+SureCartScore 83 · 80,000+Ecwid by Lightspeed Ecommerce ShoppingScore 82 · 20,000+

Facts

Version6.0.6
Authorlevelfourdevelopment
Added16 Jul 2013
Last updated29 Oct 2026
Active installs3,000+
Requires WordPress6.5
Tested up to7.1.4
Requires PHP7.3
CategoryE-commerce & Shopping
Tagsstore, ecommerce, sell online, online store, shopping cart

Questions

Is WP EasyCart still maintained?

Yes. Last release 29 Oct 2026, 67 releases in the last 24 months.

Who owns WP EasyCart, and has it changed hands?

No change recorded. Main committer levelfourstorefront since Jul 2013.

Was WP EasyCart removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WP EasyCart safe?

26 known vulnerabilities, all fixed (latest in 6.0.0). Not on the exploited list.

Is the latest WP EasyCart update safe to install?

No ownership change before 6.0.6. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue