Live › vulnerability › CVE-2026-112840
Go to dashboardSureCart, a WordPress e-commerce plugin by Brainstorm Force, fails to neutralize some user input before it is rendered in pages, enabling stored cross-site scripting. An attacker who can store content in the plugin can run scripts in other visitors' browsers, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the SureCart WordPress plugin at version 4.9.5 or earlier are affected. The risk comes from stored input that is later displayed to other users, so sites where only trusted staff can enter data face lower practical risk. Sites not running SureCart can skip this.
No product ranges from the sources yet.
wp plugin get surecart --field=version4.9.5 and confirm whether any version at or below it is installed4.9.5 as published by the vendor (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-112840")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.