The vulnerability is a subscriber Cross Site Scripting flaw in the SureCart WordPress plugin through version 4.2.2. It allows attackers to inject arbitrary HTML or JavaScript into content that is rendered to site visitors, potentially enabling theft of session cookies, phishing, or defacement. This weakness is classified as CWE‑79.

Any WordPress site running the SureCart plugin version 4.2.2 or earlier is affected. The vendor/product designation is SureCart: SureCart.

The CVSS score of 6.5 indicates medium severity. The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalogue, suggesting no known widespread exploitation. The likely attack vector is through the web interface, where a malicious subscriber or targeted visitor can trigger the stored script. When combined with social engineering or misuse of the subscriber form, the risk to confidentiality and integrity of website data is significant.