CVE-2026-107653
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.9.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g., a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.
Risk Assessment
Potential execution of malicious JavaScript in the user's browser, which could lead to session or data theft. The risk applies to sites using the SureCart plugin with visible comments.
Recommendation
Update the SureCart plugin to a version later than 4.9.4. If updating is not possible, consider disabling auto-approval of comments.
Other vulnerabilities in SureCart
See all- CVE-2026-120574High
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route allows an attacker to brute-force a 6-digit code and obtain an authenticated session as any user, including an administrator.
- CVE-2026-112840Medium
The WordPress SureCart plugin through 4.9.5 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This may allow injection of a malicious script that is stored and executed by other users.
- CVE-2026-97245High
The SureCart plugin in versions up to and including 4.7.2 contains a Privilege Escalation vulnerability exploitable by a user with Shop Worker privileges.
- CVE-2026-112241Critical
An Authentication Bypass by Spoofing vulnerability in the Brainstorm Force SureCart plugin, affecting versions through 4.9.5. It allows authentication abuse.
- CVE-2026-9065Critical
SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.
- CVE-2026-106599High
The SureCart plugin by Brainstorm Force up to version 4.9.3 contains an untrusted data deserialization vulnerability that allows Object Injection.
- CVE-2026-105874High
The SureCart plugin by Brainstorm Force up to version 4.9.3 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-109697Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS. This issue affects SureCart: from n/a through 4.9.4.
- CVE-2026-75793Medium
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
- CVE-2026-32548Medium
Broken Access Control vulnerability in SureCart versions up to 4.6.2 allows an unauthenticated attacker to bypass access controls.
Original NVD description (English source)
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g. a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS