Vulnerabilities

TI-2026-84147 CVE-2026-120574 · GHSA-wq8v-x753-g2g2

Improper authentication in SureCart – Ecommerce Made Easy For Selling Physical Products…

LOW 37

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00331 Published 2026-11-03 No fix listed CWE-287

TI-2026-83482 CVE-2026-107653 · GHSA-phr2-h83q-x5jf

Stored cross-site scripting in SureCart WordPress plugin

LOW 31

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in a…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0028 Published 2026-10-31 No fix listed CWE-79

TI-2026-75265 CVE-2026-109224 · GHSA-ppfv-pcr2-7cv3

Stored cross-site scripting in SureCart plugin for WordPress

LOW 31

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in a…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0028 Published 2026-10-16 No fix listed CWE-79

TI-2026-63986 CVE-2026-97245 · GHSA-m9hp-w7fc-x8w6

WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability

LOW 34

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00332 Published 2026-09-30 No fix listed CWE-266

TI-2026-25076 CVE-2026-32548 · GHSA-qc8j-58hh-5x43

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

LOW 30

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-08-06 No fix listed CWE-862

TI-2026-06737 CVE-2026-7655 · GHSA-6p8m-qjvm-q2jf

SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

LOW 38

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00469 Published 2026-07-11 No fix listed CWE-640

TI-2026-41251 CVE-2026-57314 · GHSA-r26v-75f4-49x2

WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-06-26 No fix listed CWE-79

TI-2026-41250 CVE-2026-57313 · GHSA-w82j-fffr-xp84

WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

LOW 28

Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00224 Published 2026-06-26 No fix listed CWE-79

TI-2026-28462 CVE-2026-39488 · GHSA-rjwp-r8m2-v94w

WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability

LOW 28

Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00191 Published 2026-04-08 No fix listed CWE-862

TI-2024-29559 CVE-2024-43970 · GHSA-c876-qjmj-7545

WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.This issue affects SureCart: from n/a through 2.29.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00271 Published 2024-09-17 No fix listed CWE-79

TI-2023-21850 CVE-2023-41241 · GHSA-v694-8fvw-63mc

WordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

LOW 26

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5.0 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00355 Published 2023-09-27 No fix listed CWE-79

Vulnerabilities

Filters