Improper neutralization of input during web page generation allows stored cross‑site scripting in the WordPress SureCart plugin. The flaw permits an attacker to embed arbitrary JavaScript into the plugin’s data fields, which is then rendered and executed for any visitor who views the affected pages. Because the input is stored persistently, the malicious script remains on the site until the data is removed or the plugin is updated, exposing users to script‑based attacks such as cookie theft, session hijacking, or defacement.

The vulnerability impacts the SureCart plugin for WordPress, affecting all releases from the earliest available version through 4.9.5 inclusive. Any installation of the plugin in that version range, installed by a vendor of Brainstorm Force, is potentially compromised.

The CVSS score of 7.1 indicates a moderate‑to‑high severity level, while the EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, suggesting limited evidence of field‑wide exploitation to date. The likely attack vector involves an attacker with the ability to submit content to the plugin’s input fields—typically an authenticated user with editing rights—though if the plugin accepts unauthenticated input, the vector widens. Once the malicious content is stored, it is presented to all site visitors, providing a persistent threat until mitigated.