Stored Cross-Site Scripting in SureCart Ecommerce Plugin for WordPress
CVE-2026-107653

7.2HIGH

Key Information:

Vendor

WordPress
Status
Surecart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Vendor
CVE Published:
31 October 2026

What is CVE-2026-107653?

The SureCart plugin for WordPress has a vulnerability that allows stored cross-site scripting via the 'comment' parameter. This flaw arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious web scripts into pages. The script executes whenever users access a compromised page, provided the injected comment is either visible or auto-approved. This vulnerability poses serious risks for users and necessitates immediate attention to secure sites using the SureCart plugin.

Affected Version(s)

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 0 <= 4.9.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/surecart/tags/...
https://plugins.trac.wordpress.org/browser/surecart/tags/...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

UKO
.