SureCart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

• CVE-2026-120574 High 8.1 SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover 0.3%
• CVE-2026-107653 High 7.2 SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments 0.3%
• CVE-2026-109224 High 7.2 SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment 0.3%
• CVE-2026-7655 High 8.1 SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook 0.5%