4.8/5
G2 rating
67 reviews
Report
Should I Use CS-Cart?
Self-hosted eCommerce software for launching and scaling online stores and marketplaces.
Depends
DependsBuy only if you're launching a serious multi-vendor marketplace and have technical staff to self-host and patch it.
Powerful self-hosted marketplace software — great for multi-vendor builds with devs; overkill and costly for a simple store.
Confidence: Medium
Yes — CS-Cart Free
Free tier
No license fee to start
Self-hosted
Deployment
On-premises PHP; you manage hosting
Unfunded
Company
Per Tracxn, Sep 2026
Value for money
4
One-time license beats SaaS fees; some transparency complaints
Ease of use
2
Self-hosted PHP; users report bugs and friction
Feature depth
4
Deep vendor, commission, multi-storefront features
Security posture
2
Multiple 2023 CVEs; self-patching burden
Pros
- 4.8/5 rating across 67 G2 reviews¹
- One-time license, more predictable pricing than Magento
- Deep multi-vendor features: commissions, vendor management, mobile app
- Named a Leader in G2's Fall marketplace report
- Free CS-Cart edition available to start
Cons
Gotchas
- highSelf-hosted means known vulnerabilities are yours to patch promptly³
- mediumOne-time license still needs an annual upgrade subscription for updates
- mediumPrices changed February 3, 2025 — verify current license costs before buying⁶
- mediumSetup adds $1,000–$10,000 in extra marketplace build costs beyond the license
Best for
- Multi-vendor marketplace builders
- Teams with PHP/server skills
- B2B wholesale marketplaces
- Buyers avoiding SaaS subscription fees
Not for
- Solo sellers who just need a simple store
- Non-technical teams with no server admin
- Anyone wanting transparent subscription pricing
- Teams unwilling to patch security themselves
Companies that use it
- TackleTarts
- Fête du Café
- Unixmo
- HSQ (17 global storefronts)⁷
Pricing
Multi-Vendor Standard
One-time license — see /compare
- Single marketplace storefront
- Vendor commissions and payouts
Ultimate
One-time license — see /compare
- Unlimited storefronts
- Priority support
B2B
One-time license — see /compare
- Bulk orders, wholesale features
Security
Several CVEs since 2023 in Multi-Vendor; self-hosting puts patching on you.
- CVE-2023-26686 — File Upload vulnerabilityFile upload vulnerability in CS-Cart Multi-Vendor.³
- GHSA-h863-2hm3-rc4r — Directory TraversalDirectory traversal vulnerability in CS-Cart Multi-Vendor.
- CVE-2023-26690 — File Upload vulnerabilityFile upload vulnerability in CS-Cart Multi-Vendor.
- Authenticated RCE in CS-Cart 1.3.3 (legacy)Public exploit for remote code execution in old CS-Cart 1.3.3 installs.⁴
What users say
G2 ratings are strong (4.8/5), but some users report bugs, checkout issues, and pricing transparency complaints.
“No need to pay for the license and search for ...”
“We have experienced a lot of issues, bugs, checko...”
“If you can't be transparent about you...”
Alternatives
Compare CS-Cart with each alternative.
Shopify
Hosted and easy; marketplace possible via apps
CS-Cart vs ShopifyWooCommerce
WordPress-based, cheaper marketplace with plugins
CS-Cart vs WooCommerceSharetribe
No-code marketplace SaaS, fastest launch
CS-Cart vs SharetribeMagento (Adobe Commerce)
Enterprise-grade but heavier and costlier
CS-Cart vs Magento (Adobe Commerce)Full analysis
Based on 40+ public sources: G2/Trustpilot reviews, CVE databases, official pricing pages, and vendor case studies.
Sources
review
review
- CVE-2023-26686 Detail — NVDnvd.nist.govsecurity
- CS-Cart 1.3.3 authenticated RCE — Exploit-DBexploit-db.comsecurity
- Official CS-Cart Multi-Vendor Pricingcs-cart.comofficial
- CS-Cart in 2025: Price Updatescs-cart.comofficial
- Case Study: HSQ — 17 Global Storefrontscs-cart.comofficial
- Facebook group user complaint on issues/bugsfacebook.comreview
Rate this review
Anonymous. You can change your vote.
Loading votes…
Ask a follow-up
Ask if a use case fits. Answers stay inside this report and its sources.
Comments
One queue. No replies. Give a display name first. Limit: 7 comments per day.
No comments yet.