This vulnerability is a reflected Cross‑Site Scripting flaw in the Brainstorm Force SureCart WordPress plugin. An attacker can inject arbitrary JavaScript into the content that is sent to a victim’s browser, allowing credential theft, defacement, or malicious redirects. The weakness is an input processing flaw, categorized as CWE‑79, that fails to neutralize user‑supplied data before rendering it as part of a web page.

The issue affects the SureCart plugin from any release before 4.9.4, including all versions up to and including 4.9.3. It is relevant to WordPress sites that have installed or are running the SureCart plugin series by Brainstorm Force.

The CVSS score of 7.1 indicates a high severity risk. The EPSS score is 0.00204, demonstrating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting it is not known to be widely exploited. The likely attack vector requires that a victim follows a crafted link or URL containing malicious payloads; the plugin does not properly escape or validate that input, enabling it to execute in the victim’s browser with the privileges of the site user. Even though the exposure is limited to the pages served by the plugin, the impact on confidentiality, integrity, or availability is significant if a malicious script can steal cookies or perform unauthorized actions.