Surecart
Monthly
Authentication bypass by spoofing in Brainstorm Force's SureCart WordPress plugin affects versions through 4.9.5 and, per the CVSS vector, is reachable over the network without authentication or user interaction, with high confidentiality, integrity, and availability impact. The exact spoofing mechanism and any required configuration are not described in the supplied sources, and no public exploit was identified at time of analysis. The vuln.today priority is act_now.
Stored cross-site scripting in the SureCart WordPress plugin through 4.9.5 lets an authenticated attacker persist malicious script that runs when a victim renders the affected content, enabling browser-session actions under the victim's privileges. The issue is rated CVSS 7.1 High with UI:R and scope change; no public exploit code or CISA KEV confirmation is present in the provided intelligence.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
Privilege escalation in the SureCart WordPress plugin through version 4.7.2 allows an authenticated user who holds the limited 'Shop Worker' store-staff role to elevate to full administrator-level control of the WordPress site. The flaw is a case of incorrect privilege assignment (CWE-266) inside a SureCart operation, and because the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, no user interaction or special conditions are needed once the Shop Worker role is held - making it a straightforward path for a malicious insider or anyone who has compromised a shop-staff credential. Anonymous or self-registering visitors cannot reach the flaw; there is no public exploit identified at time of analysis.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.
SQL injection in SureCart WordPress plugin versions prior to 4.2.1 allows authenticated high-privileged attackers to extract arbitrary database contents via the /surecart/v1/integrations/{id} REST endpoint. The flaw stems from a sanitization bypass in the wp-query-builder component where payloads containing a dot character skip $wpdb->prepare() escaping entirely, enabling UNION-based data exfiltration. No public exploit identified at time of analysis, though Tenable Research has published technical details (TRA-2026-43).
Unauthenticated information disclosure in the SureCart WordPress plugin before 4.9.5 allows anonymous visitors to pull merchant-private catalog metadata - pricing, commission, stock levels, SKU and tax internals, including unpublished products - by abusing the include parameters of the plugin's public single-upsell-funnel REST endpoint. The endpoint neither restricts which related objects a caller may request nor strips private fields from the returned objects, so any reachable storefront exposing at least one upsell funnel is affected without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists according to the WPScan reference, and the vendor has released a patch in version 4.9.5; impact is bounded to catalog disclosure, with no customer records, credentials, write access, or code execution exposed.
Stored cross-site scripting in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.5) allows an authenticated low-privileged user to persist a script payload that later executes in a higher-privileged administrator's browser when the affected page is viewed, matching CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5). Because exploitation requires both a foothold account capable of submitting the stored data and victim interaction, the practical risk is bounded rather than a self-propagating compromise, and the scope change (S:C) means the payload executes in the administrator's session context rather than the attacker's. No public exploit code and no CISA KEV entry were identified at time of analysis, and the available data does not identify a fixed SureCart release, so sites on 4.9.5 or earlier should be treated as unpatched pending confirmation from the Patchstack advisory.
Stored cross-site scripting in the SureCart WordPress plugin (Brainstorm Force / SureCart) through version 4.9.4 allows a low-privilege authenticated user to persist malicious JavaScript into plugin-rendered content, which then executes in the browser of any user who views the affected page. Rated CVSS 6.5 (medium), the flaw is remote and network-reachable (AV:N) but tempered by two prerequisites: an attacker must first hold a valid low-privilege account (PR:L), and a victim - typically a site administrator or another authenticated user - must load the poisoned page for the payload to fire (UI:R). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so this appears to be a coordinated disclosure via Patchstack rather than a defect under active exploitation; exposure is highest on sites that allow untrusted visitors to self-register customer or contributor accounts.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.
Missing authorization controls in SureCart WordPress plugin versions up to 4.0.2 allow authenticated attackers to access or modify restricted data due to incorrectly configured access control security levels. With CVSS 6.3 (authenticated attack, low complexity, confidentiality/integrity/availability impact) and EPSS 0.02% exploitation probability, this represents a moderate-severity flaw affecting plugin deployments where user role separation is security-critical; no public exploit code or active exploitation has been confirmed.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.29.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass by spoofing in Brainstorm Force's SureCart WordPress plugin affects versions through 4.9.5 and, per the CVSS vector, is reachable over the network without authentication or user interaction, with high confidentiality, integrity, and availability impact. The exact spoofing mechanism and any required configuration are not described in the supplied sources, and no public exploit was identified at time of analysis. The vuln.today priority is act_now.
Stored cross-site scripting in the SureCart WordPress plugin through 4.9.5 lets an authenticated attacker persist malicious script that runs when a victim renders the affected content, enabling browser-session actions under the victim's privileges. The issue is rated CVSS 7.1 High with UI:R and scope change; no public exploit code or CISA KEV confirmation is present in the provided intelligence.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
Privilege escalation in the SureCart WordPress plugin through version 4.7.2 allows an authenticated user who holds the limited 'Shop Worker' store-staff role to elevate to full administrator-level control of the WordPress site. The flaw is a case of incorrect privilege assignment (CWE-266) inside a SureCart operation, and because the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, no user interaction or special conditions are needed once the Shop Worker role is held - making it a straightforward path for a malicious insider or anyone who has compromised a shop-staff credential. Anonymous or self-registering visitors cannot reach the flaw; there is no public exploit identified at time of analysis.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.
SQL injection in SureCart WordPress plugin versions prior to 4.2.1 allows authenticated high-privileged attackers to extract arbitrary database contents via the /surecart/v1/integrations/{id} REST endpoint. The flaw stems from a sanitization bypass in the wp-query-builder component where payloads containing a dot character skip $wpdb->prepare() escaping entirely, enabling UNION-based data exfiltration. No public exploit identified at time of analysis, though Tenable Research has published technical details (TRA-2026-43).
Unauthenticated information disclosure in the SureCart WordPress plugin before 4.9.5 allows anonymous visitors to pull merchant-private catalog metadata - pricing, commission, stock levels, SKU and tax internals, including unpublished products - by abusing the include parameters of the plugin's public single-upsell-funnel REST endpoint. The endpoint neither restricts which related objects a caller may request nor strips private fields from the returned objects, so any reachable storefront exposing at least one upsell funnel is affected without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists according to the WPScan reference, and the vendor has released a patch in version 4.9.5; impact is bounded to catalog disclosure, with no customer records, credentials, write access, or code execution exposed.
Stored cross-site scripting in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.5) allows an authenticated low-privileged user to persist a script payload that later executes in a higher-privileged administrator's browser when the affected page is viewed, matching CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5). Because exploitation requires both a foothold account capable of submitting the stored data and victim interaction, the practical risk is bounded rather than a self-propagating compromise, and the scope change (S:C) means the payload executes in the administrator's session context rather than the attacker's. No public exploit code and no CISA KEV entry were identified at time of analysis, and the available data does not identify a fixed SureCart release, so sites on 4.9.5 or earlier should be treated as unpatched pending confirmation from the Patchstack advisory.
Stored cross-site scripting in the SureCart WordPress plugin (Brainstorm Force / SureCart) through version 4.9.4 allows a low-privilege authenticated user to persist malicious JavaScript into plugin-rendered content, which then executes in the browser of any user who views the affected page. Rated CVSS 6.5 (medium), the flaw is remote and network-reachable (AV:N) but tempered by two prerequisites: an attacker must first hold a valid low-privilege account (PR:L), and a victim - typically a site administrator or another authenticated user - must load the poisoned page for the payload to fire (UI:R). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so this appears to be a coordinated disclosure via Patchstack rather than a defect under active exploitation; exposure is highest on sites that allow untrusted visitors to self-register customer or contributor accounts.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.
Missing authorization controls in SureCart WordPress plugin versions up to 4.0.2 allow authenticated attackers to access or modify restricted data due to incorrectly configured access control security levels. With CVSS 6.3 (authenticated attack, low complexity, confidentiality/integrity/availability impact) and EPSS 0.02% exploitation probability, this represents a moderate-severity flaw affecting plugin deployments where user role separation is security-critical; no public exploit code or active exploitation has been confirmed.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.29.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.