Surecart Ecommerce Made Easy For Selling Physical Products Digital Downloads Subscriptions Donations Payments
Monthly
Stored cross-site scripting in the SureCart ecommerce plugin for WordPress, affecting all versions up to and including 4.9.4, lets unauthenticated visitors submit comment content that is stored without sufficient sanitization and rendered without adequate escaping, so attacker-supplied script runs in the browser of anyone who later views an affected page. The Wordfence-reported issue is scored 7.2 with a scope change (script executes in the victim's context), but our assessment raises attack complexity to High because the payload only executes if the comment is auto-approved or approved by a moderator and a victim then visits a page that loads SureCart's web-component bundle, such as a page containing a Buy Button block. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the vendor priority is this_week.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.
Stored cross-site scripting in the SureCart ecommerce plugin for WordPress, affecting all versions up to and including 4.9.4, lets unauthenticated visitors submit comment content that is stored without sufficient sanitization and rendered without adequate escaping, so attacker-supplied script runs in the browser of anyone who later views an affected page. The Wordfence-reported issue is scored 7.2 with a scope change (script executes in the victim's context), but our assessment raises attack complexity to High because the payload only executes if the comment is auto-approved or approved by a moderator and a victim then visits a page that loads SureCart's web-component bundle, such as a page containing a Buy Button block. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the vendor priority is this_week.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.