Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting (XSS)
Action: Immediate Patch
AI Analysis

Impact

This vulnerability arises from improper neutralization of user‑supplied input during web page rendering in the SureCart plugin, allowing stored XSS. The weakness is classified as CWE‑79.

Affected Systems

The flaw affects WordPress sites that have the Brainstorm Force SureCart plugin installed on any version up to and including 4.9.5. Versions later than 4.9.5 are not vulnerable.

Risk and Exploitability

With a CVSS score of 6.5, the vulnerability presents moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KE catalog. Exploitation requires the attacker to submit input that the plugin accepts and subsequently stores, which is then rendered on a page viewed by other users. The likely attack vector is through any plugin feature that accepts user content without proper output sanitization.

Generated by OpenCVE AI on October 20, 2026 at 18:00 UTC.

Remediation

Vendor Solution

Update the WordPress SureCart plugin to the latest available version (at least 4.9.6).

OpenCVE Recommended Actions

  • Apply the latest SureCart plugin version (4.9.6 or later).
  • If an immediate update is not possible, disable or restrict any plugin functionality that accepts user input and injects it into the page, or apply custom output sanitization to the affected fields.
  • Monitor the site for unapproved scripts or anomalous activity and enforce a content security policy that blocks inline scripts.

Generated by OpenCVE AI on October 20, 2026 at 18:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Brainstormforce
Brainstormforce surecart
Wordpress-extensions
Wordpress-extensions surecart
Vendors & Products Brainstormforce
Brainstormforce surecart
Wordpress-extensions
Wordpress-extensions surecart

Tue, 20 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
Title WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Brainstormforce Surecart
Wordpress-extensions Surecart
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-21T10:35:08.866Z

Reserved: 2026-10-19T19:23:59.819Z

Link: CVE-2026-112840

cve-icon Vulnrichment

Updated: 2026-10-21T10:27:57.316Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T16:17:04.150

Modified: 2026-10-21T11:17:06.960

Link: CVE-2026-112840

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T20:30:41Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')