CVE-2026-107653: SureCart Stored XSS
CVE-2026-107653 (CVSS 7.2, High) is a stored cross-site scripting vulnerability in the SureCart ecommerce plugin for WordPress, which handles physical products, digital downloads, subscriptions, donations, and payments. The comment parameter is not sufficiently sanitized, so attacker-supplied script can be stored and later run in the browser of anyone who views the affected page.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-107653 |
| CVSS Score | 7.2 (High) |
| Weakness | Stored cross-site scripting |
| Affected Software | SureCart plugin for WordPress |
| Affected Versions | All versions up to and including 4.9.4 |
| Vulnerable Parameter | comment |
Impact
Stored XSS in a store plugin matters because the injected script can run in a logged-in administrator's session. Possible outcomes include:
- Creating administrator accounts or changing settings through the admin's session
- Stealing session data or redirecting visitors
- Tampering with checkout pages in ways that could expose payment-related details
Remediation
- Update SureCart to the latest release available in the WordPress plugin directory, a version later than 4.9.4.
- Review stored content that accepts a
commentvalue (orders, notes) for unexpected script or HTML. - Use a WAF with XSS rules as a stopgap, and limit administrator browsing while logged in.
wp plugin list --name=surecart --fields=name,version,update
wp plugin update surecartKey Takeaways
- CVE-2026-107653 affects SureCart 4.9.4 and earlier.
- The flaw is stored XSS through the
commentparameter. - Update the plugin and audit stored comment data.