Overview
A high-severity Stored Cross-Site Scripting vulnerability, tracked as CVE-2026-109224, has been disclosed in SureCart, a popular WordPress e-commerce plugin used to sell physical products, digital downloads, subscriptions, and donations. The flaw carries a CVSS 3.1 score of 7.2 and affects all versions through 4.9.4.
The vulnerability lives in how SureCart handles the comment field: the plugin fails to adequately sanitize input or escape output before it reaches the template attribute of the sc-cart-loader web component, which renders its content via an innerHTML sink. Because the flaw requires no authentication, an attacker can plant a malicious comment on any page that will later execute arbitrary JavaScript for every visitor who loads it — including store administrators.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-109224 |
| CVSS 3.1 Score | 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| CWE | CWE-79 — Improper Neutralization of Input During Web Page Generation |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | Required (a victim must load the affected page) |
| Affected Component | comment field rendered through the sc-cart-loader template attribute |
| Affected Versions | SureCart, all versions through 4.9.4 |
| Fixed Version | 4.9.5 |
| Assigner | Wordfence |
| Reported By | R3D |
| Reserved / Published | 2026-10-12 / 2026-10-16 |
How It Works
SureCart's sc-cart-loader component accepts a template attribute and renders it using innerHTML rather than safe DOM text insertion. When a comment field is displayed back on a storefront page, SureCart does not sufficiently sanitize the stored value or escape it on output before it can reach that sink.
Exploitation has a specific trigger condition: the malicious comment must appear on a post or page that loads the surecart-components runtime — for example, one that embeds a [sc_buy_button] shortcode — and that page must not contain an sc-checkout element. Under those conditions, the vulnerable innerHTML code path in sc-cart-loader fires, and any HTML or script tags stored in the comment field execute in the browser of whoever views the page.
Because no authentication is required to plant the comment, and the resulting script executes for every subsequent visitor — including logged-in administrators — this is a classic unauthenticated stored XSS: the attacker's input persists server-side rather than requiring a victim to click a crafted link.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | Low-to-moderate — stored session cookies, auth tokens, or admin nonces can be exfiltrated if an admin views the injected page |
| Integrity | Low-to-moderate — a script running in an admin's session can perform any action that admin is authorized to perform, including creating new admin users |
| Availability | None directly, though a malicious payload could deface or disrupt storefront pages |
| Authentication Required | None — the comment can be submitted by an unauthenticated visitor |
| User Interaction | A victim (customer or administrator) must load the page containing the stored comment |
Who Is At Risk
- Any WordPress site running SureCart version 4.9.4 or earlier
- Stores that use the
[sc_buy_button]shortcode on pages without a dedicatedsc-checkoutelement — the condition that activates the vulnerable rendering path - Sites that allow public or low-trust comment submission anywhere SureCart's components are loaded
Attack Chain
- Injection — An unauthenticated attacker submits a crafted
commentvalue containing an HTML/script payload targeting a page that loads SureCart's components. - Storage — The comment is saved without sufficient sanitization.
- Trigger — A victim (ideally a store administrator) loads the affected page;
sc-cart-loaderrenders the stored comment throughinnerHTML. - Execution — The injected script runs in the victim's browser session, with the ability to steal cookies, forge admin actions, or redirect visitors.
Mitigation
Immediate Actions
- Update SureCart to version 4.9.5 or later. SureCart shipped 4.9.5 on October 13, 2026 as a "Security Hardening & Fixes" release, which improved output escaping and input sanitization across several areas, including this issue, credited to researchers from Patchstack and Wordfence.
- Audit recent comments on pages that use the
[sc_buy_button]shortcode for unexpected HTML,<script>tags, or encoded payloads submitted before patching. - If immediate patching isn't possible, consider disabling public comments on pages that load SureCart's components until the update is applied.
Detection Opportunities
- Search the WordPress comments table for entries containing
<script,onerror=,onload=, or other common XSS payload markers. - Monitor admin-side browser sessions for unexpected outbound requests or new admin-user creation immediately after visiting storefront pages.
Defence-in-Depth
- Keep SureCart and all WordPress plugins/themes on their latest releases — stored XSS severity often compounds when combined with other plugin weaknesses.
- Where feasible, apply a Content Security Policy (CSP) that restricts inline script execution to reduce the blast radius of any stored-XSS payload that slips through.
- Limit administrator browsing of public-facing, comment-enabled pages to hardened browser profiles or sessions with reduced privileges where practical.
Discovery & Disclosure
CVE-2026-109224 was reserved on October 12, 2026 and published on October 16, 2026, with Wordfence as the assigning CNA and researcher R3D credited with the report. The fix landed in SureCart 4.9.5 just three days before public disclosure. As of publication, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploit has surfaced, though technical details of the vulnerable code path are already documented.