SureCart vulnerabilities
11 published CVEs name SureCart among the affected products.
- Published CVEs
- 11
- Last 12 months
- 9
- Critical
- 0
- Known exploited
- 0
Critical 0High 7Medium 4Low 0Not scored 0
CVEs per yearBy the year they were published
- 20231
- 20241
- 20269
Newest CVEs
- CVE-2026-120574
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover
surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
High8.1 - CVE-2026-107653
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
High7.2 - CVE-2026-109224
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
High7.2 - CVE-2026-97245
WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability
SureCart · SureCart
High7.2 - CVE-2026-32548
WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability
SureCart · SureCart
Medium5.3 - CVE-2026-7655
SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook
surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
High8.1 - CVE-2026-57314
WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
SureCart · SureCart
High7.1 - CVE-2026-57313
WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability
SureCart · SureCart
Medium6.5 - CVE-2026-39488
WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability
SureCart · SureCart
Medium6.5 - CVE-2024-43970
WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability
SureCart · SureCart
High7.1