CVE-2026-107653

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitizatio...

CVE-2026-107653 SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitizatio...

EUVD-2026-114596

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitizatio...

CVE-2026-107653

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.9.4 . The flaw exists due to insufficient input sanitization and output escaping of the 'comment' parameter . An unauthenticated attacker can inject arbitrary web scripts tha...

CVE-2026-107653: surecart: The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &…

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitizatio...

CVE-2026-112241

Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability

Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability

Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112241

The SureCart WordPress plugin (versions

EUVD-2026-108068

Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5...

PT-2026-121303

Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5...

WordPress SureCart authorization issue vulnerability

WordPress SureCart versions 4.9.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from susceptibility to deception attacks, leading to authentication bypass and potential for unauthorized use of authentication mechanisms...

CVE-2026-112221

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112221

The SureCart WordPress plugin (versions

EUVD-2026-107278

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112221 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112221 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-108073

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

CVE-2026-108073

The SureCart WordPress plugin, in versions prior to 4.9.5 , is vulnerable to an unauthenticated private catalog data disclosure. The root cause is that the plugin fails to restrict related objects or strip private fields when an anonymous visitor reads a single upsell funnel via the REST API . Th...

WordPress SureCart plugin < 4.9.5 - Unauthenticated Private Catalog Data Disclosure vulnerability

Unauthenticated Private Catalog Data Disclosure vulnerability discovered by cyberkareem in WordPress Plugin SureCart versions 4.9.5...