CVE-2026-57314

8th percentile — higher than 8% of all known CVEs

SureCart plugin version 4.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.

Immediately update the SureCart plugin to a version newer than 4.3.2. Also review and sanitize all user input data.