CVE-2026-112840: WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SureCart pluginto a version that resolves this vulnerability.Fixed in 4.9.6
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The attack is network-reachable and has low attack complexity.
What versions are affected?
SureCart versions through 4.9.5 are affected. The available data does not identify a fixed version.
What is the potential impact if exploitation succeeds?
This is a stored XSS issue with scope changed in the CVSS vector. It may result in low-impact compromise of confidentiality, integrity, and availability.