Executive brief
SureCart is a popular e-commerce solution for WordPress websites. A security vulnerability in versions 4.2.2 and earlier allows users with basic 'Subscriber' accounts to inject malicious scripts into the site. If an administrator or another visitor views the affected area, these scripts could be used to redirect users to malicious websites, display unauthorized advertisements, or potentially compromise user sessions.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the SureCart plugin for WordPress (versions <= 4.2.2) due to improper neutralization of input during web page generation (CWE-79). The flaw allows an authenticated attacker with 'Subscriber' privileges to inject malicious HTML or JavaScript payloads. Successful exploitation requires a victim (such as an administrator) to interact with a crafted page or view the injected content. This can lead to unauthorized script execution in the victim's browser session, potentially resulting in data theft or site defacement. The issue is resolved in version 4.2.3.
Affected products
- SureCart SureCart <= 4.2.2
Timeline
- 2026-04-30: other: Vulnerability reported by researcher
- 2026-06-25: advisory: Patchstack advisory published
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Version 4.2.3 released to address the vulnerability