{"id":"CVE-2026-124411","kind":"vulnerability","aliases":["CVE-2026-124411"],"related":[],"title":"SureCart WordPress plugin: stored XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.","summary":"SureCart, a WordPress plugin from Brainstorm Force, fails to neutralize user input before it is rendered on a page. An attacker who can store content in the site can run scripts in the browser of other visitors or administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","surecart","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SureCart plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/surecart/`","fix":"- SureCart: a fixed version is not stated in the sources; versions through `4.12.1` are affected","status":"open","published_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:29:20+00:00","updated_at":"2026-11-11T13:29:20+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:20Z","model":"claude-haiku-5-5","output":{"fix":"- SureCart: a fixed version is not stated in the sources; versions through `4.12.1` are affected\n- unknown","reach":"internet","title":"SureCart WordPress plugin: stored XSS through input handling","impact":"medium","summary":"SureCart, a WordPress plugin from Brainstorm Force, fails to neutralize user input before it is rendered on a page. An attacker who can store content in the site can run scripts in the browser of other visitors or administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","surecart","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in other users' browsers on the site.","analyst_note":"Confirm the fixed SureCart version and the required privilege level from the NVD page or the WordPress plugin advisory.","how_to_check":"- Check the installed SureCart plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/surecart/`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SureCart WordPress plugin at version 4.12.1 or earlier. The flaw is stored XSS, so the risk depends on who can enter content that is later shown to other users; the sources do not say which roles or inputs are involved.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4543,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124411':11A,14A '-2026':10A,13A '4.12.1':87C 'administr':59B 'affect':82C 'allow':78C 'attack':41B 'brainstorm':26B,74C 'browser':54B 'content':45B 'cross':69C 'cross-sit':68C 'cve':9A,12A 'fail':28B 'forc':27B,75C 'generat':67C 'handl':8A 'host':18B 'improp':60C 'input':7A,32B,63C 'issu':81C 'n/a':85C 'neutral':30B,61C 'packag':15B 'page':39B,66C 'plugin':3A,24B 'render':36B 'run':50B 'script':51B,71C 'self':17B 'self-host':16B 'site':48B,70C 'store':4A,44B,79C 'surecart':1A,19B,21B,76C,77C,83C 'user':31B 'visitor':57B 'vulner':72C 'web':65C 'wordpress':2A,20B,23B 'xss':5A 'xss.this':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureCart WordPress plugin at version 4.12.1 or earlier. The flaw is stored XSS, so the risk depends on who can enter content that is later shown to other users; the sources do not say which roles or inputs are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","surecart","wordpress"],"campaign_type":null,"search_a":"'-124411':11A,14A '-2026':10A,13A 'cve':9A,12A 'handl':8A 'input':7A 'plugin':3A 'store':4A 'surecart':1A 'wordpress':2A 'xss':5A","search_b":"'administr':59B 'attack':41B 'brainstorm':26B 'browser':54B 'content':45B 'fail':28B 'forc':27B 'host':18B 'input':32B 'neutral':30B 'packag':15B 'page':39B 'plugin':24B 'render':36B 'run':50B 'script':51B 'self':17B 'self-host':16B 'site':48B 'store':44B 'surecart':19B,21B 'user':31B 'visitor':57B 'wordpress':20B,23B","search_c":"'4.12.1':87C 'affect':82C 'allow':78C 'brainstorm':74C 'cross':69C 'cross-sit':68C 'forc':75C 'generat':67C 'improp':60C 'input':63C 'issu':81C 'n/a':85C 'neutral':61C 'page':66C 'script':71C 'site':70C 'store':79C 'surecart':76C,77C,83C 'vulner':72C 'web':65C 'xss.this':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124411","severity":null,"published_at":"2026-11-11T13:17:18+00:00","modified_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}