The vulnerability is an improper neutralization of input during web page generation that allows an attacker to store malicious script code in the SureCart plugin. This stored XSS flaw means that data entered through user input fields can be rendered in subsequent page views without sanitisation, potentially enabling session hijacking, credential theft, or defacement. The weakness corresponds to CWE-79 and can compromise both confidentiality and availability of affected WordPress sites if an attacker supplies crafted input.

Brainstorm Force SureCart plugin for WordPress is affected in all releases up to and including version 4.9.4. Any WordPress installation that has a version n/a through 4.9.4 deployed is vulnerable. The issue does not appear in version 4.9.5 or newer.

The CVSS base score of 6.5 classifies this flaw as a medium severity vulnerability, and users should be aware that the EPSS score is not available for this entry. Because the flaw is stored XSS, an attacker with access to input fields can inject persistent malicious code, which then executes in the browsers of site visitors or site administrators. This attack does not require privileged access and can be attempted through publicly accessible forms or administrative interfaces, making it a realistic threat for sites that expose or accept user content through the plugin.