{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/surecart--4.9.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:surecart:surecart:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109224"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SureCart (\u003c= 4.9.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SureCart"],"content_html":"\u003cp\u003eThe SureCart plugin for WordPress (up to and including version 4.9.4) contains a critical Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-109224. The vulnerability stems from insufficient input sanitization and output escaping on the 'comment' parameter. An unauthenticated attacker can supply a crafted malicious script payload within a comment field. The script becomes stored in the WordPress database and subsequently executes in the browser of any authenticated or unauthenticated user who visits a page containing the [sc_buy_button] shortcode. Execution is dependent on specific client-side conditions where the page does not contain an 'sc-checkout' element, which triggers an insecure innerHTML sink within the plugin's 'sc-cart-loader' component. This vulnerability poses a significant risk for session hijacking, unauthorized actions on behalf of administrators, or the injection of malicious content into e-commerce storefronts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser. If the victim is an administrator, this can lead to full site compromise, unauthorized configuration changes, or the creation of new administrative accounts. The vulnerability affects any WordPress installation utilizing the SureCart plugin version 4.9.4 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the SureCart WordPress plugin to the version containing the security fix (if available, consult the vendor for patches beyond 4.9.4). Monitor web server logs for HTTP POST requests directed at comment submission endpoints that contain script tags or suspicious JavaScript patterns, as these may indicate attempts to inject payloads into the database. Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS payloads by restricting the execution of inline scripts and unauthorized external resources.\u003c/p\u003e\n","date_modified":"2026-10-16T10:25:49Z","date_published":"2026-10-16T10:25:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-surecart-xss/","summary":"The SureCart plugin for WordPress (\u003c= 4.9.4) is vulnerable to Stored Cross-Site Scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victims viewing specific e-commerce pages.","title":"Stored Cross-Site Scripting in SureCart WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-surecart-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - SureCart (\u003c= 4.9.4)","version":"https://jsonfeed.org/version/1.1"}