CVE-2026-124411: WordPress SureCart plugin <= 4.12.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SureCart pluginto a version that resolves this vulnerability.Fixed in 4.13.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges and user interaction. It is network-accessible and can result in stored cross-site scripting.
Which SureCart versions are affected?
SureCart versions through 4.12.1 are affected. The available information does not identify a fixed version.
What impact can successful exploitation have?
The listed impact includes low confidentiality, integrity, and availability effects, with scope changed. Because this is stored XSS, malicious input may be retained and later execute when viewed by another user.