Plugin icon

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

surecart

Vulnerabilities:

15

Last Updated:

October 15, 2026

Active Installs:

80000

Published
Title
Fixed in
CVSS
Published
2026-10-15
Title
SureCart < 4.9.5 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
Fixed in
Fixed in 4.9.5
CVSS
7.2 (high)
Published
2026-10-13
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.9.5
CVSS
5.5 (medium)
Published
2026-10-12
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.9.4 - Authenticated (Custom Role+) PHP Object Injection
Fixed in
Fixed in 4.9.4
CVSS
7.5 (high)
Published
2026-10-12
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.9.4 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 4.9.4
CVSS
7.2 (high)
Published
2026-09-24
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.7.3 - Authenticated (Shop Worker+) Privilege Escalation
Fixed in
Fixed in 4.7.3
CVSS
6.3 (medium)
Published
2026-09-04
Title
SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login
Fixed in
Fixed in 4.7.0
CVSS
6.5 (medium)
Published
2026-09-04
Title
SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover
Fixed in
Fixed in 4.6.3
CVSS
8.8 (high)
Published
2026-08-06
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.6.3 - Missing Authorization
Fixed in
Fixed in 4.6.3
CVSS
5.3 (medium)
Published
2026-07-10
Title
SureCart < 4.3.0 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook
Fixed in
Fixed in 4.3.0
CVSS
8.1 (high)
Published
2026-06-26
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.3.3 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.3.3
CVSS
6.1 (medium)
Published
2026-06-25
Title
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.2.3
CVSS
6.4 (medium)
Published
2026-05-20
Title
SureCart < 4.2.1 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 4.2.1
CVSS
4.9 (medium)
Published
2026-03-26
Title
SureCart < 4.0.3 - Missing Authorization
Fixed in
Fixed in 4.0.3
CVSS
4.3 (medium)
Published
2024-08-28
Title
SureCart < 2.29.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.29.4
CVSS
6.1 (medium)
Published
2023-08-29
Title
SureCart < 2.5.1 - Admin+ Stored XSS
Fixed in
Fixed in 2.5.1
CVSS
3.5 (low)