Cpe:2.3:a:surecart:surecart:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asurecartsurecartwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 10:25:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in SureCart WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-surecart-xss/Fri, 16 Oct 2026 10:25:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-surecart-xss/The SureCart plugin for WordPress (<= 4.9.4) is vulnerable to Stored Cross-Site Scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victims viewing specific e-commerce pages.The SureCart plugin for WordPress (up to and including version 4.9.4) contains a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-109224. The vulnerability stems from insufficient input sanitization and output escaping on the 'comment' parameter. An unauthenticated attacker can supply a crafted malicious script payload within a comment field. The script becomes stored in the WordPress database and subsequently executes in the browser of any authenticated or unauthenticated user who visits a page containing the [sc_buy_button] shortcode. Execution is dependent on specific client-side conditions where the page does not contain an 'sc-checkout' element, which triggers an insecure innerHTML sink within the plugin's 'sc-cart-loader' component. This vulnerability poses a significant risk for session hijacking, unauthorized actions on behalf of administrators, or the injection of malicious content into e-commerce storefronts.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser. If the victim is an administrator, this can lead to full site compromise, unauthorized configuration changes, or the creation of new administrative accounts. The vulnerability affects any WordPress installation utilizing the SureCart plugin version 4.9.4 or earlier.

Recommendation

Update the SureCart WordPress plugin to the version containing the security fix (if available, consult the vendor for patches beyond 4.9.4). Monitor web server logs for HTTP POST requests directed at comment submission endpoints that contain script tags or suspicious JavaScript patterns, as these may indicate attempts to inject payloads into the database. Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS payloads by restricting the execution of inline scripts and unauthorized external resources.

]]>highadvisory