{"id":"CVE-2026-112840","kind":"vulnerability","aliases":["CVE-2026-112840"],"related":[],"title":"SureCart WordPress plugin: stored XSS through input handling up to 4.9.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.","summary":"SureCart, a WordPress e-commerce plugin by Brainstorm Force, fails to neutralize some user input before it is rendered in pages, enabling stored cross-site scripting. An attacker who can store content in the plugin can run scripts in other visitors' browsers, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","surecart","wordpress"],"not_affected_if":["fixed-version-installed","surecart-not-installed"],"how_to_check":"- Check the installed SureCart plugin version in the WordPress admin Plugins screen or with `wp plugin get surecart --field=version`\n- Compare the result against the fixed version `4.9.5` and confirm whether any version at or below it is installed","fix":"- Update the SureCart plugin to a version later than `4.9.5` as published by the vendor (fixed version unknown from sources)\n- Until updated, restrict which accounts can submit or edit stored content in SureCart forms","status":"open","published_at":"2026-10-20T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:55:33+00:00","updated_at":"2026-10-25T03:55:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:55:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update the SureCart plugin to a version later than `4.9.5` as published by the vendor (fixed version unknown from sources)\n- Until updated, restrict which accounts can submit or edit stored content in SureCart forms","reach":"internet","title":"SureCart WordPress plugin: stored XSS through input handling up to 4.9.5","impact":"medium","summary":"SureCart, a WordPress e-commerce plugin by Brainstorm Force, fails to neutralize some user input before it is rendered in pages, enabling stored cross-site scripting. An attacker who can store content in the plugin can run scripts in other visitors' browsers, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","surecart","ecommerce"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed SureCart version and the exact vulnerable input path from the vendor advisory or the NVD entry.","how_to_check":"- Check the installed SureCart plugin version in the WordPress admin Plugins screen or with `wp plugin get surecart --field=version`\n- Compare the result against the fixed version `4.9.5` and confirm whether any version at or below it is installed","needs_analyst":true,"not_affected_if":["surecart-not-installed","fixed-version-installed"],"who_is_affected":"Sites running the SureCart WordPress plugin at version 4.9.5 or earlier are affected. The risk comes from stored input that is later displayed to other users, so sites where only trusted staff can enter data face lower practical risk. Sites not running SureCart can skip this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3307,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112840':14A,17A '-2026':13A,16A '4.9.5':11A,95C 'administr':67B 'affect':90C 'allow':86C 'attack':51B 'brainstorm':30B,82C 'browser':65B 'commerc':27B 'content':55B 'cross':47B,77C 'cross-sit':46B,76C 'cve':12A,15A 'e':26B 'e-commerc':25B 'ecommerc':18B 'enabl':44B 'fail':32B 'forc':31B,83C 'generat':75C 'handl':8A 'improp':68C 'includ':66B 'input':7A,37B,71C 'issu':89C 'n/a':93C 'neutral':34B,69C 'packag':19B 'page':43B,74C 'plugin':3A,28B,58B 'render':41B 'run':60B 'script':49B,61B,79C 'site':48B,78C 'store':4A,45B,54B,87C 'surecart':1A,20B,22B,84C,85C,91C 'user':36B 'visitor':64B 'vulner':80C 'web':73C 'wordpress':2A,21B,24B 'xss':5A 'xss.this':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureCart WordPress plugin at version 4.9.5 or earlier are affected. The risk comes from stored input that is later displayed to other users, so sites where only trusted staff can enter data face lower practical risk. Sites not running SureCart can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112840","severity":null,"published_at":"2026-10-20T16:17:04+00:00","modified_at":"2026-10-21T11:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}