Surecart Vulnerabilities

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.6.2. This makes it possible for unauthenticated attacker...

CVSS:

5.3

Affected:

up to 4.6.2

Fixed in:

4.6.3

Disclosed:

Aug 6, 2026

CVE-2026-32548 on NVD →

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it...

CVSS:

8.1

Affected:

up to 4.2.3

Fixed in:

4.3.0

Disclosed:

Jul 10, 2026

CVE-2026-7655 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for un...

CVSS:

6.1

Affected:

up to 4.3.2

Fixed in:

4.3.3

Disclosed:

Jun 26, 2026

CVE-2026-57314 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authe...

CVSS:

6.4

Affected:

up to 4.2.2

Fixed in:

4.2.3

Disclosed:

Jun 25, 2026

CVE-2026-57313 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVSS:

4.9

Affected:

up to 4.2.0

Fixed in:

4.2.1

Disclosed:

May 20, 2026

CVE-2026-9065 on NVD →

The SureCart plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.0.2

Fixed in:

4.0.3

Disclosed:

Mar 26, 2026

CVE-2026-39488 on NVD →

The SureCart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.29.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick...

CVSS:

6.1

Affected:

up to 2.29.3

Fixed in:

2.29.4

Disclosed:

Aug 28, 2024

CVE-2024-43970 on NVD →

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary we...

CVSS:

4.4

Affected:

up to 2.5.0

Fixed in:

2.5.1

Disclosed:

Aug 29, 2023

CVE-2023-41241 on NVD →