CVE-2026-57314
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
SureCart plugin version 4.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
Risk Assessment
The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the SureCart plugin to a version newer than 4.3.2. Also review and sanitize all user input data.
Other vulnerabilities in SureCart
See all- CVE-2026-9065Critical
SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.
- CVE-2026-32548Medium
Broken Access Control vulnerability in SureCart versions up to 4.6.2 allows an unauthenticated attacker to bypass access controls.
- CVE-2026-7655High
The SureCart plugin for WordPress up to version 4.2.3 is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of user identity before updating details like email during customer profile synchronization from webhook events. Unauthenticated attackers can change linked user email addresses, including administrators if their account is linked to a SureCart customer record, and then reset the password to gain access if the customer ID is known.
- CVE-2026-39488Medium
The SureCart plugin for WordPress up to version 4.0.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.