Stored Cross-Site Scripting Vulnerability in SureCart Plugin for WordPress
CVE-2026-109224

7.2HIGH

Key Information:

Vendor

WordPress
Status
Surecart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Vendor
CVE Published:
16 October 2026

What is CVE-2026-109224?

The SureCart plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability due to inadequate validation of user input in the 'comment' parameter. Attackers can exploit this flaw to inject arbitrary scripts into web pages, which will execute when a user visits a compromised page. Successful attacks necessitate that the malicious comment appears within a post that utilizes the SureCart components runtime, notably where specific conditions are met regarding the absence of an sc-checkout element. This flaw emphasizes the importance of rigorous input sanitization and output escaping to safeguard against malicious exploits.

Affected Version(s)

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 0 <= 4.9.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/surecart/tags/...
https://plugins.trac.wordpress.org/browser/surecart/tags/...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

R3D
.