Surecart Vulnerabilities

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping....

CVSS:

7.2

(Wordfence)

Affected:

up to 4.9.4

Fixed in:

4.9.5

Disclosed:

Oct 15, 2026

CVE-2026-109224 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.9.4. This is due to insufficient input sanitization and output escaping. This makes it possi...

CVSS:

6.4

(Wordfence)

Affected:

up to 4.9.4

Fixed in:

4.9.5

Disclosed:

Oct 13, 2026

CVE-2026-109697 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.3. This is due to deserialization of untrusted input. This makes it possible for authenticated at...

CVSS:

7.5

(Wordfence)

Affected:

up to 4.9.3

Fixed in:

4.9.4

Disclosed:

Oct 12, 2026

CVE-2026-106599 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.9.3. This is due to insufficient input sanitization and output escaping. This makes it possi...

CVSS:

7.2

(Wordfence)

Affected:

up to 4.9.3

Fixed in:

4.9.4

Disclosed:

Oct 12, 2026

CVE-2026-105874 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.2. This is due to insufficient restriction on the capabilities a user may grant themselves. This...

CVSS:

6.3

(Wordfence)

Affected:

up to 4.7.2

Fixed in:

4.7.3

Disclosed:

Sep 24, 2026

CVE-2026-97245 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to unauthorized account creation in all versions up to 4.7.0 (exclusive). This makes it possible for unauthenticated attackers to register on sites where registrat...

CVSS:

5.3

(Wordfence)

Affected:

up to 4.7.0

Fixed in:

4.7.0

Disclosed:

Sep 8, 2026

CVE-2026-75793 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to 4.6.3 (exclusive). This is due to the plugin not properly validating a user's identity prior to...

CVSS:

8.8

(Wordfence)

Affected:

up to 4.6.3

Fixed in:

4.6.3

Disclosed:

Sep 7, 2026

CVE-2026-18480 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.6.2. This makes it possible for unauthenticated attacker...

CVSS:

5.3

(Wordfence)

Affected:

up to 4.6.2

Fixed in:

4.6.3

Disclosed:

Aug 6, 2026

CVE-2026-32548 on NVD →

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it...

CVSS:

8.1

(Wordfence)

Affected:

up to 4.2.3

Fixed in:

4.3.0

Disclosed:

Jul 10, 2026

CVE-2026-7655 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for un...

CVSS:

6.1

(Wordfence)

Affected:

up to 4.3.2

Fixed in:

4.3.3

Disclosed:

Jun 26, 2026

CVE-2026-57314 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authe...

CVSS:

6.4

(Wordfence)

Affected:

up to 4.2.2

Fixed in:

4.2.3

Disclosed:

Jun 25, 2026

CVE-2026-57313 on NVD →

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVSS:

4.9

(Wordfence)

Affected:

up to 4.2.0

Fixed in:

4.2.1

Disclosed:

May 20, 2026

CVE-2026-9065 on NVD →

The SureCart plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

(Wordfence)

Affected:

up to 4.0.2

Fixed in:

4.0.3

Disclosed:

Mar 26, 2026

CVE-2026-39488 on NVD →

The SureCart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.29.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick...

CVSS:

6.1

(Wordfence)

Affected:

up to 2.29.3

Fixed in:

2.29.4

Disclosed:

Aug 28, 2024

CVE-2024-43970 on NVD →

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary we...

CVSS:

4.4

(Wordfence)

Affected:

up to 2.5.0

Fixed in:

2.5.1

Disclosed:

Aug 29, 2023

CVE-2023-41241 on NVD →