CVE-2026-112221: WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Q: Which SureCart versions are affected?

SureCart versions through 4.9.5 are affected. The available data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

The vector is network-accessible and has low attack complexity. Exploitation requires user interaction, while no attacker privileges are required according to the supplied vector.

Q: What is the potential impact of successful exploitation?

The vulnerability is stored XSS and may affect confidentiality, integrity, and availability at low impact levels. Its scope is changed, meaning the impact can extend beyond the vulnerable component's original security authority.

Published Oct 21, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

Affected Software

1 affected component

Brainstorm Force SureCart<=4.9.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress SureCart plugin to a version that resolves this vulnerability.
Fixed in 4.9.6

Event History

Oct 21, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which SureCart versions are affected?

SureCart versions through 4.9.5 are affected. The available data does not identify a fixed version.

What does an attacker need to exploit this issue?

The vector is network-accessible and has low attack complexity. Exploitation requires user interaction, while no attacker privileges are required according to the supplied vector.

What is the potential impact of successful exploitation?

The vulnerability is stored XSS and may affect confidentiality, integrity, and availability at low impact levels. Its scope is changed, meaning the impact can extend beyond the vulnerable component's original security authority.

CVE-2026-112221: WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which SureCart versions are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which SureCart versions are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?