Log in Start free

SureCart

Products

ProductCVEsExploitedLatest
SureCart6–Sep 30, 2026
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments4–Nov 3, 2026
WordPress Ecommerce For Creating Fast Online Stores1–Sep 27, 2023

Exploited and recent CVEs

  • CVE-2026-120574 High 8.1 SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover 0.3%
  • CVE-2026-107653 High 7.2 SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments 0.3%
  • CVE-2026-109224 High 7.2 SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment 0.3%
  • CVE-2026-97245 High 7.2 WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability 0.3%
  • CVE-2026-32548 Medium 5.3 WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-7655 High 8.1 SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook 0.5%
  • CVE-2026-57314 High 7.1 WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-57313 Medium 6.5 WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-39488 Medium 6.5 WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability 0.2%
  • CVE-2024-43970 High 7.1 WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2023-41241 Medium 5.9 WordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS) 0.4%