CVE-2026-109697: WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SureCart pluginto a version that resolves this vulnerability.Fixed in 4.9.5
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector requires network access, low privileges, and user interaction. This indicates an authenticated low-privilege attacker must cause another user to interact with the injected content.
Are SureCart versions later than 4.9.4 affected?
The affected range is stated as SureCart versions through 4.9.4. The provided information does not identify a specific fixed version.
What impact can successful exploitation have?
The vulnerability is stored XSS and is rated medium severity with low impacts to confidentiality, integrity, and availability. Its scope is changed, meaning the vulnerable component can affect resources outside its own security authority.