SureCart EUVD-2026-98363

Exploitation requires a low-privilege authenticated account on the target site (CVSS PR:L) - the description does not name a specific vulnerable feature or form, but stored XSS implies a persistent input field that SureCart renders without neutralization. Execution is gated by user interaction (UI:R): a victim (typically an administrator or another user) must load the page containing the stored payload for the script to fire. Limiting factors are therefore the need for at least one valid low-privilege account (relevant on sites allowing customer/contributor registration) and the dependency on a privileged victim viewing the injected content; sites that do not permit untrusted account creation substantially reduce exposure. Affected deployments are SureCart versions up to and including 4.9.4.

This is a stored Cross-Site Scripting flaw (CWE-79) in the SureCart WordPress plugin, scored CVSS 6.5 (medium). The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable exploitation of low complexity, but it explicitly requires PR:L - so an attacker must hold a low-privilege authenticated account - and UI:R, meaning a victim must subsequently view the injected content. The scope change (S:C) reflects that the stored payload executes in the browser context of other users (e.g. admins or shoppers), which is the real risk driver. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input; there is therefore no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent rather than conflicting: a medium CVSS, no KEV, and no known POC together point to a genuine but lower-tier priority - patch in normal cycles rather than as an emergency. The main caveat is that stored XSS requiring only a low-privilege account can be meaningful on multi-author or customer-registration-enabled stores, where many untrusted accounts exist. EPSS data is absent, so empirical exploitation probability could not be factored in.

An attacker who holds a low-privilege authenticated account on a SureCart-enabled WordPress site (such as a customer or contributor) submits input that is stored without proper neutralization. When an administrator or another user later views the page rendering that stored data, the malicious script executes in their browser, potentially enabling session/cookie theft or admin-context actions. No public proof-of-concept is identified in the provided data.