The Simple Shopping Cart WordPress plugin before version 5.2.6 does not escape certain setting field values when rendering the admin settings page; administrators can embed arbitrary JavaScript that will execute in the browser context of any administrator who visits the settings page, potentially allowing credential theft, session hijacking or other client‑side compromise. The vulnerability is a stored client‑side flaw and does not provide a direct remote code execution path on the server.

WordPress sites that use the Simple Shopping Cart plugin with any version earlier than 5.2.6 are affected. The issue impacts both single‑site and multisite networks, and is particularly serious on multisite installations where administrators lack the unfiltered_html capability.

This is an unfiltered input flaw that enables stored XSS in the admin settings page. No public exploit is known, and the CVSS score is 3.5 while the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Because it requires a user with administrator privileges to introduce the payload, the likelihood of exploitation depends on how easily an attacker can gain such access; once an attacker has admin rights, the impact can be high, allowing compromise of administrative sessions or injection of malicious client‑side code.