{"id":"CVE-2026-112221","kind":"vulnerability","aliases":["CVE-2026-112221"],"related":[],"title":"SureCart WordPress plugin: stored XSS through input handling before 4.9.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.","summary":"SureCart, a WordPress e-commerce plugin by Brainstorm Force, fails to neutralize user input before it is rendered in web pages, enabling stored cross-site scripting. An attacker who can store input in the site can run script in the browser of anyone who views the affected page, such as an administrator.","severity":"high","cvss":7.1,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","surecart","wordpress"],"not_affected_if":["surecart-not-installed"],"how_to_check":"- Check the installed SureCart plugin version in the WordPress admin Plugins screen or with `wp plugin get surecart --field=version`\n- Confirm whether the version is `4.9.5` or earlier","fix":"- Update SureCart to a version later than `4.9.5`\n- unknown: the sources do not name the exact patched release","status":"open","published_at":"2026-10-21T15:17:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:48+00:00","updated_at":"2026-10-25T03:31:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update SureCart to a version later than `4.9.5`\n- unknown: the sources do not name the exact patched release","reach":"internet","title":"SureCart WordPress plugin: stored XSS through input handling before 4.9.5","impact":"medium","summary":"SureCart, a WordPress e-commerce plugin by Brainstorm Force, fails to neutralize user input before it is rendered in web pages, enabling stored cross-site scripting. An attacker who can store input in the site can run script in the browser of anyone who views the affected page, such as an administrator.","category":"package","nicknames":[],"who_cares":["wordpress","surecart","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers on the site","analyst_note":"Check the NVD entry and the Brainstorm Force SureCart changelog for the patched version and the vulnerable input fields and required privileges.","how_to_check":"- Check the installed SureCart plugin version in the WordPress admin Plugins screen or with `wp plugin get surecart --field=version`\n- Confirm whether the version is `4.9.5` or earlier","needs_analyst":true,"not_affected_if":["surecart-not-installed"],"who_is_affected":"Sites running the SureCart WordPress plugin at version `4.9.5` or earlier are affected. The sources do not say which input fields or roles are involved, so the exposed paths are unknown. Sites without SureCart installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000613,"input_tokens":3346,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112221':13A,16A '-2026':12A,15A '4.9.5':10A,104C 'administr':76B 'affect':71B,99C 'allow':95C 'anyon':67B 'attack':52B 'brainstorm':31B,91C 'browser':65B 'commerc':28B 'cross':48B,86C 'cross-sit':47B,85C 'cve':11A,14A 'e':27B 'e-commerc':26B 'enabl':45B 'fail':33B 'forc':32B,92C 'generat':84C 'handl':8A 'host':20B 'improp':77C 'input':7A,37B,56B,80C 'issu':98C 'n/a':102C 'neutral':35B,78C 'packag':17B 'page':44B,72B,83C 'plugin':3A,29B 'render':41B 'run':61B 'script':50B,62B,88C 'self':19B 'self-host':18B 'site':49B,59B,87C 'store':4A,46B,55B,96C 'surecart':1A,21B,23B,93C,94C,100C 'user':36B 'view':69B 'vulner':89C 'web':43B,82C 'wordpress':2A,22B,25B 'xss':5A 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureCart WordPress plugin at version `4.9.5` or earlier are affected. The sources do not say which input fields or roles are involved, so the exposed paths are unknown. Sites without SureCart installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112221","severity":null,"published_at":"2026-10-21T15:17:16+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112221","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112221","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}