Simple Shopping Cart CVE-2026-104119

Exploitation requires an authenticated high-privilege user (administrator, per PR:H) with access to the Simple Shopping Cart settings page to save a malicious value into one of the unescaped settings fields, and additionally requires a victim administrator to subsequently load that admin settings page (UI:R) for the stored script to fire. The practically meaningful scenario is a WordPress MULTISITE installation where site administrators do NOT hold the unfiltered_html capability - there the flaw bypasses the restriction that would normally sanitize their input. Limiting factors: single-site installs where admins already have unfiltered_html gain little, the attacker must already hold administrator-level access, and no unauthenticated or no-interaction path exists. Affected: Simple Shopping Cart versions 0 through before 5.2.6; fixed in 5.2.6.

This is a low-priority, high-barrier Stored XSS (CWE-79) whose raw signals all point the same direction. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N, base 3.5) confirms that exploitation requires HIGH privileges (PR:H - i.e., an administrator) plus victim interaction (UI:R), and yields only Low confidentiality and integrity impact with no availability impact. EPSS agrees it is not a mass-exploitation candidate: 0.15% probability at the 4th percentile. The vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; however, publicly available exploit code exists (referenced via WPScan), so the technique is documented and reproducible. These signals are consistent rather than conflicting - a genuinely low-real-risk, high-CVSS-is-not-even-the-case issue since the CVSS itself is Low. The one nuance that raises relative concern is the described context: the flaw is 'notably impactful on multisite installations where administrators do not have the unfiltered_html capability,' meaning it lets a restricted site administrator inject script they would otherwise be blocked from injecting - a privilege/trust-boundary bypass within multisite rather than a remote takeover vector. No key data is missing or contradictory; the description's 'high-privilege users such as administrators' aligns cleanly with the PR:H in the CVSS vector.

On a WordPress multisite network, a site-level administrator who lacks the unfiltered_html capability saves a crafted JavaScript payload into an unescaped Simple Shopping Cart settings field. The payload is stored and later rendered unescaped on the plugin's admin settings page, executing in the browser of any administrator (including higher-privileged network admins) who views that page. Publicly available exploit code exists documenting this injection.