Stored Cross-Site Scripting in SureCart WordPress Plugin

The SureCart plugin for WordPress (up to and including version 4.9.4) contains a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-109224. The vulnerability stems from insufficient input sanitization and output escaping on the 'comment' parameter. An unauthenticated attacker can supply a crafted malicious script payload within a comment field. The script becomes stored in the WordPress database and subsequently executes in the browser of any authenticated or unauthenticated user who visits a page containing the [sc_buy_button] shortcode. Execution is dependent on specific client-side conditions where the page does not contain an 'sc-checkout' element, which triggers an insecure innerHTML sink within the plugin's 'sc-cart-loader' component. This vulnerability poses a significant risk for session hijacking, unauthorized actions on behalf of administrators, or the injection of malicious content into e-commerce storefronts.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser. If the victim is an administrator, this can lead to full site compromise, unauthorized configuration changes, or the creation of new administrative accounts. The vulnerability affects any WordPress installation utilizing the SureCart plugin version 4.9.4 or earlier.

Recommendation

Update the SureCart WordPress plugin to the version containing the security fix (if available, consult the vendor for patches beyond 4.9.4). Monitor web server logs for HTTP POST requests directed at comment submission endpoints that contain script tags or suspicious JavaScript patterns, as these may indicate attempts to inject payloads into the database. Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS payloads by restricting the execution of inline scripts and unauthorized external resources.