The SureCart plugin for WordPress contains an insufficient input sanitization bug that allows an attacker to store a malicious script in a comment. The script is later injected into the page through the sc-cart-loader, which renders the comment content as innerHTML on a page that includes a [sc_buy_button] shortcode but does not contain a sc‑checkout element. A victim who views that page would have the attacker’s script executed in their browser, potentially enabling cookie theft, session hijacking, defacement, or other client‑side attacks. The impact is limited to how the script is used by the attacker, but because the vulnerability does not require authentication, any user who can post a comment on a suitable page can cause the malicious payload to execute.

All installations of the SureCart "Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments" plugin for WordPress up to and including version 4.9.4 are affected. The flaw resides in the handling of the comment parameter in the BlockServiceProvider component. No other products or vendors are listed as impacted.

The CVSS score of 7.2 indicates a high severity and the overall risk is elevated because the attacker only needs to create or modify a comment on a page that loads the surecart-components runtime; no authentication is required. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the lack of an availability gap and the broad exposure of the comment system mean that exploitation is straightforward. An attacker could exploit this vulnerability by creating a comment containing a script that maliciously manipulates the DOM or steals credentials whenever an end‑user loads the vulnerable page.