CVE-2026-32548

Unauthenticated Broken Access Control in SureCart = 4.6.2 versions...

CVE-2026-32548

CVE-2026-32548 describes an unauthenticated broken access control in the WordPress WordPress SureCart plugin, affected versions up to 4.6.2. The vulnerability is characterized by unauthenticated access with low confidentiality impact and no impact on integrity or availability, per CVSS 3.1 metric...

EUVD-2026-53955

Unauthenticated Broken Access Control in SureCart = 4.6.2 versions...

CVE-2026-32548 WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in SureCart = 4.6.2 versions...

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin SureCart versions = 4.6.2...

CVE-2026-7655

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

CVE-2026-7655 SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

EUVD-2026-43148

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...

CVE-2026-7655

The CVE identifies a vulnerability in the SureCart WordPress plugin up to version 4.2.3. It allows privilege escalation via account takeover by forged customer.updated webhook events because the plugin does not properly validate a user’s identity before updating details (e.g., email) during custo...

PT-2026-57403

Name of the Vulnerable Software and Affected Versions SureCart versions prior to 4.2.4 Description An issue exists that allows privilege escalation via account takeover. The software fails to properly validate a user's identity when updating details, such as the email address, during customer...

CVE-2026-13039

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...

EUVD-2026-43025

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...

CVE-2026-57314

Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...

CVE-2026-57313

Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...

EUVD-2026-39726

Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...

CVE-2026-57313

Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...

CVE-2026-57314 WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...

CVE-2026-57313 WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...

EUVD-2026-39727

Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...

CVE-2026-57313

CVE-2026-57313 concerns a Subscriber XSS vulnerability in the WordPress plugin SureCart up to version 4.2.2 . The public records describe an XSS issue affecting subscribers, but do not provide concrete exploit scenarios, affected subcomponents, or a detailed root cause beyond the general class of...