SureCart CVE-2026-107653

Exploitation requires three specific conditions stated in the description: (1) the attacker-submitted comment must be auto-approved or approved by a moderator - standard WordPress moderation of first-time/unauthenticated commenters is therefore a limiting factor; (2) the injected comment must be rendered on a page that loads SureCart's web-component bundle, for example a page containing a SureCart Buy Button block - pages without SureCart blocks do not trigger it; and (3) a victim must then visit that specific page. Affected: SureCart plugin versions up to and including 4.9.4. The unauthenticated-injection step (PR:N) lowers the entry barrier, but the mandatory comment-approval gate and the requirement for a SureCart-bundle page materially constrain realistic exploitation.

This is a stored XSS (CWE-79) in the SureCart WordPress plugin, rated CVSS 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, meaning network-reachable, unauthenticated injection with a changed scope (script executes in victims' browser context). The real-world priority is moderate rather than acute: there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active exploitation, and no public exploit code is identified - the references are the Wordfence advisory and WordPress plugin source/changeset links, not working exploit code. The nominal AC:L conflicts with the description's stated preconditions: successful execution requires the injected comment to be auto-approved or moderator-approved AND to render on a page that loads SureCart's web-component bundle (e.g., one containing a SureCart Buy Button block), which in practice raises attack complexity above what AC:L implies. The vuln.today 'this_week' decision label and Wordfence sourcing mark it as worth remediating promptly, but the combination of required comment approval and a specific page composition means this is a genuine-but-conditional issue rather than a drop-everything emergency; absence of EPSS/KEV data is a gap, not a confirmation of low risk.

An unauthenticated attacker submits a comment containing a malicious script payload via the 'comment' parameter on a SureCart-enabled WordPress site. If the comment is auto-approved or later approved by a moderator and is displayed on a page that loads SureCart's web-component bundle (such as a page with a SureCart Buy Button block), the script executes in the browser of every visitor who views that page, enabling session or content manipulation. No public exploit code is identified at time of analysis; the trigger path is corroborated only by the Wordfence advisory and plugin source references.