Live › vulnerability › CVE-2026-112221
Go to dashboardSureCart, a WordPress e-commerce plugin by Brainstorm Force, fails to neutralize user input before it is rendered in web pages, enabling stored cross-site scripting. An attacker who can store input in the site can run script in the browser of anyone who views the affected page, such as an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the SureCart WordPress plugin at version or earlier are affected. The sources do not say which input fields or roles are involved, so the exposed paths are unknown. Sites without SureCart installed can skip it.
4.9.5No product ranges from the sources yet.
wp plugin get surecart --field=version4.9.5 or earlier4.9.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-112221")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.