CVE-2026-107653

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.9.4 . The flaw exists due to insufficient input sanitization and output escaping of the 'comment' parameter . An unauthenticated attacker can inject arbitrary web scripts tha...

EUVD-2026-114596

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitizatio...

CVE-2026-107653: surecart: The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &…

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitizatio...