SureCart CVE-2026-105874

Exploitation requires the attacker to deliver a crafted URL containing the XSS payload and have a logged-in SureCart/WordPress user (typically an administrator or store operator) actively click it (CVSS UI:R) - the payload is reflected, so there is no persistence and each victim must be individually lured. No authentication is required of the attacker (PR:N), and it works against default configurations of SureCart versions up to and including 4.9.3. The primary limiting factor is the mandatory user interaction: without a victim clicking the malicious link in an authenticated session, the flaw cannot be triggered, which substantially narrows realistic exploitation compared to a no-interaction vulnerability.

This is a moderate-risk, not top-priority, issue. The CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects network reach, low complexity, no privileges, and a changed scope, but the vulnerability is Reflected XSS - meaning exploitation hinges on tricking an authenticated victim (typically an admin or store user) into clicking an attacker-crafted link (UI:R). No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no public exploit code was referenced, so there is no public exploit identified at time of analysis. The sole source is a Patchstack advisory, which is a credible WordPress-vulnerability feed but a single source. The CVSS A:L (availability impact) is questionable for a reflected XSS and likely reflects Patchstack's conservative scoring convention rather than a genuine availability effect - verify against vendor detail. Overall: a legitimate issue to patch, but the user-interaction requirement and absence of exploitation signals (no KEV, no POC, no EPSS) place it below actively-exploited or unauthenticated-RCE-class flaws in prioritization.

An attacker crafts a malicious URL targeting a vulnerable SureCart endpoint that reflects attacker-controlled input into the page without proper neutralization, then lures a logged-in store administrator or customer into clicking it (e.g., via email or a forum link). When the victim's browser loads the page, injected JavaScript executes in the WordPress site's origin, allowing session/cookie theft, admin actions, or redirection. No public proof-of-concept was referenced in the provided data.