Surecart vulnerabilities

Products

• Surecart 17

Newest

• surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover CVE-2026-120574 8.1 HighNovember 3, 2026
• surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments CVE-2026-107653 7.2 HighOctober 31, 2026
• brainstorm force surecart WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability CVE-2026-112241 9.8 CriticalOctober 22, 2026
• brainstorm force surecart WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-112221 7.1 HighOctober 21, 2026
• surecart SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter CVE-2026-108073 5.3 MediumOctober 21, 2026
• brainstorm force surecart WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-112840 6.5 MediumOctober 20, 2026
• surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment CVE-2026-109224 7.2 HighOctober 16, 2026
• brainstorm force surecart WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability CVE-2026-106599 8.8 HighOctober 14, 2026
• brainstorm force surecart WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-105874 7.1 HighOctober 14, 2026
• brainstorm force surecart WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-109697 6.5 MediumOctober 13, 2026
• surecart WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability CVE-2026-97245 7.2 HighSeptember 30, 2026
• surecart SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login CVE-2026-75793 6.5 MediumSeptember 6, 2026
• surecart SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover CVE-2026-18480 8.8 HighSeptember 6, 2026
• surecart WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability CVE-2026-32548 5.3 MediumAugust 6, 2026
• surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook CVE-2026-7655 8.1 HighJuly 11, 2026
• surecart WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57314 7.1 HighJune 26, 2026
• surecart WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-57313 6.5 MediumJune 26, 2026
• brainstormforce surecart Surecart - SQL Injection CVE-2026-9065 9.3 CriticalMay 20, 2026
• surecart WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability CVE-2026-39488 6.5 MediumApril 8, 2026
• brainstorm force suremembers SureMembers <= 1.10.6 - Sensitive Information Exposure CVE-2024-12434 5.3 MediumFebruary 26, 2025
• surecart WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-43970 7.1 HighSeptember 17, 2024
• surecart, surecart wordpress ecommerce for creating fast online stores +1 more WordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS) CVE-2023-41241 5.9 MediumSeptember 27, 2023