Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

SureCart vulnerabilities

11 published CVEs name SureCart among the affected products.

Atom feed of new CVEs

Newest CVEs

  • CVE-2026-120574

    SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover

    surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

    High8.1
  • CVE-2026-107653

    SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments

    surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

    High7.2
  • CVE-2026-109224

    SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment

    surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

    High7.2
  • CVE-2026-97245

    WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability

    SureCart · SureCart

    High7.2
  • CVE-2026-32548

    WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

    SureCart · SureCart

    Medium5.3
  • CVE-2026-7655

    SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

    surecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

    High8.1
  • CVE-2026-57314

    WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    SureCart · SureCart

    High7.1
  • CVE-2026-57313

    WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

    SureCart · SureCart

    Medium6.5
  • CVE-2026-39488

    WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability

    SureCart · SureCart

    Medium6.5
  • CVE-2024-43970

    WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability

    SureCart · SureCart

    High7.1
All 11 in the list