Filtered by vendor Surecart Subscriptions
Filtered by product Surecart Subscriptions

Search

Switch to Advanced Search (Beta)
Total 9 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-109224 2 Surecart, Wordpress-extensions 2 Surecart, Surecart 2026-10-23 7.2 High
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.
CVE-2026-18480 2 Surecart, Wordpress 2 Surecart, Wordpress 2026-09-06 8.8 High
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
CVE-2026-75793 2 Surecart, Wordpress 2 Surecart, Wordpress 2026-09-06 6.5 Medium
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
CVE-2026-32548 2 Surecart, Wordpress 2 Surecart, Wordpress 2026-08-06 5.3 Medium
Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
CVE-2026-57314 2 Surecart, Wordpress 2 Surecart, Wordpress 2026-06-29 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.
CVE-2026-57313 2 Surecart, Wordpress 2 Surecart, Wordpress 2026-06-26 6.5 Medium
Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.
CVE-2026-39488 2 Surecart, Wordpress 2 Surecart, Wordpress 2026-04-29 6.5 Medium
Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.
CVE-2023-41241 1 Surecart 1 Surecart 2024-11-21 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5.0 versions.
CVE-2024-43970 1 Surecart 1 Surecart 2024-09-25 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.This issue affects SureCart: from n/a through 2.29.3.