WordPress security by component
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Plugin description
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Jul 11, 2026; the highest CVE/CNA score is 8.1.
Plugin slug:
surecartLatest vulnerability
CVE-2026-7655: SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments: Privilege escalation or authentication bypass
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 4.2.3.
| Safe version |
|
||
|---|---|---|---|
| Jul 11, 2026 |
CVE-2026-7655
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments: Privilege escalation or authentication bypass
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 4.2.3.
|
> 4.2.3 |
CVE8.1
NVDPending
|
| Jun 26, 2026 |
CVE-2026-57314
SureCart: Cross-site scripting
SureCart is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.3.2.
|
4.3.3 |
CVE7.1
NVDPending
|
| Jun 26, 2026 |
CVE-2026-57313
SureCart: Cross-site scripting
SureCart is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.2.2.
|
4.2.3 |
CVE6.5
NVDPending
|
| Apr 08, 2026 |
CVE-2026-39488
SureCart: A security weakness
SureCart is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.0.2.
|
4.0.3 |
CVE6.5
NVDPending
|
| Sep 18, 2024 |
CVE-2024-43970
SureCart: Cross-site scripting
SureCart is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Sep 27, 2023 |
CVE-2023-41241
Surecart: Cross-site scripting
Surecart is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|