SureCart CVE-2026-109224

Exploitation requires a very specific server-side condition: the injected comment must be rendered on a WordPress post/page that loads the SureCart surecart-components runtime (for example, a page using the [sc_buy_button] shortcode) AND that page must NOT contain an sc-checkout element - this combination is what routes the unsanitized comment into the vulnerable innerHTML sink in sc-cart-loader. The attacker side is unauthenticated (PR:N), but successful code execution additionally depends on a victim visiting the affected page and on the site actually using the qualifying shortcode layout. Sites that do not embed SureCart buy-button shortcodes on comment-bearing posts, or whose affected pages include an sc-checkout element, are not exploitable, which significantly limits the real-world attack surface despite the unauthenticated entry point.

This is a stored XSS (CWE-79) in the SureCart WordPress plugin with an input CVSS of 7.2 and a vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicating a network-reachable, unauthenticated, scope-changing flaw. The PR:N metric confirms unauthenticated injection, which raises concern because any visitor can submit the malicious 'comment' value. However, the real-world risk is materially lower than the raw score suggests because execution is gated by specific, non-default conditions described by the vendor: the comment must land on a post that loads the surecart-components runtime (e.g. via an [sc_buy_button] shortcode) AND that page must contain no sc-checkout element, so that the vulnerable innerHTML sink in sc-cart-loader is reached. The input vector encodes AC:L, but these stacked site-configuration prerequisites arguably warrant AC:H, and reliable execution depends on a victim subsequently visiting the affected page (favoring UI:R over the input's UI:N) - this is the main conflict between the stated vector and the description. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data; the finding comes from Wordfence (a credible WordPress-vulnerability source). Net assessment: a legitimate stored-XSS issue worth patching, but not a widespread drive-by threat - exploitability is conditional on store configuration rather than universal, so treat it as moderate priority rather than emergency.

An unauthenticated attacker submits a comment containing a crafted script payload to a SureCart-enabled WordPress site. If the comment is displayed on a post that loads the surecart-components runtime via an [sc_buy_button] shortcode and lacks an sc-checkout element, the sc-cart-loader's innerHTML sink renders the payload, and the script executes in the browser of any user who later views that page. No public exploit code is identified at time of analysis.