Vulnerabilities and security researches forsurecart surecart
Direction: ascendingWordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2023-41241
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Sep 27, 2023
- Research Description
- Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5.0 versions.
- Affected versions
-
max 2.5.1.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2024-43970
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Sep 18, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.This issue affects SureCart: from n/a through 2.29.3.
- Affected versions
-
max 2.29.4.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-39488
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Apr 08, 2026
- Research Description
- Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.
- Affected versions
-
max 4.0.3.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-9065
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- May 20, 2026
- Research Description
- SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escaping bypass in the query builder ('wp-query-builder'). Values passed to the 'where()' method are only sanitized via '$wpdb->prepare()' when they do **not** contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the 'WHERE' clause, allowing full UNION-based extraction of the database.
- Affected versions
-
max 4.2.1.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-57313
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Jun 26, 2026
- Research Description
- Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.
- Affected versions
-
max 4.2.3.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-57314
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Jun 26, 2026
- Research Description
- Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.
- Affected versions
-
max 4.3.3.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-7655
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Jul 11, 2026
- Research Description
- The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.
- Affected versions
-
max 4.3.0.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-32548
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Aug 06, 2026
- Research Description
- Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
- Affected versions
-
max 4.6.3.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-18480
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Sep 06, 2026
- Research Description
- The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
- Affected versions
-
max 4.6.3.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-75793
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Sep 06, 2026
- Research Description
- The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
- Affected versions
-
max 4.7.0.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-97245
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Sep 30, 2026
- Research Description
- Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
- Affected versions
-
max 4.7.3.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-109697
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Oct 13, 2026
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.
- Affected versions
-
max 4.9.5.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-109224
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- -
- Research Description
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart] < 4.9.5 CVE-2026-109224
- Affected versions
-
max 4.9.5.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-112840
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Oct 20, 2026
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
- Affected versions
-
max 4.9.6.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-112241
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Oct 22, 2026
- Research Description
- Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
- Affected versions
-
max 4.9.6.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-107653
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Oct 31, 2026
- Research Description
- The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g. a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.
- Affected versions
-
max 4.9.6.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-120574
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Nov 03, 2026
- Research Description
- The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.
- Affected versions
-
max 4.9.6.
- Status
-
vulnerable
WordPress Ecommerce For Creating Fast Online Stores – By SureCart # CVE-2026-124411
- CVE, Research URL
- Home page URL
-
Security reports for WordPress Ecommerce For Creating Fast Online Stores – By SureCart
- Date
- Nov 11, 2026
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.
- Affected versions
-
max 4.13.0.
- Status
-
vulnerable