The vulnerability in SureCart allows an attacker to store malicious JavaScript code in the comment field of orders without authentication. When the stored comment is displayed on a page that loads the SureCart web‑component bundle, the injected script executes in the victim’s browser. This can lead to cookie theft, session hijacking, defacement, or execution of further malicious code. The weakness is a classic stored XSS flaw tied to inadequate input sanitization and output escaping.

Any WordPress site running SureCart version 4.9.4 or older is affected. The plugin must be installed on a page that hosts a SureCart Buy Button block or similar component so that the comment is rendered. Sites that still use the vulnerable plugin and have auto‑approval enabled for comments or have moderators that approve them are the most exposed.

With a CVSS score of 7.2 the vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalogue, but the attack surface remains large because the flaw is exploitable without any authentication, only requiring that a comment becomes visible. Attackers can exploit this by posting a crafted comment and deferring approval until the content is rendered, or by waiting for auto‑approval if the site allows it. The resulting impact depends on the victim’s privileges but can compromise user sessions and enable phishing or further attacks.