CVE-2026-105874: WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SureCart pluginto a version that resolves this vulnerability.Fixed in 4.9.4
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be performed remotely with low complexity and does not require authentication, but it requires user interaction. Successful exploitation depends on convincing a user to interact with attacker-controlled content or a crafted request.
What is the potential impact if exploitation succeeds?
The vulnerability is rated high with a CVSS score of 7.1. It may allow impacts to confidentiality, integrity, and availability, each assessed as low, and can affect components beyond the vulnerable plugin's security authority.
Which SureCart versions are affected?
SureCart versions through 4.9.3 are affected. The available data does not identify a fixed version.