SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Reflected Cross-Site Scripting via 'live_mode' Parameter

ID

WPSEC-2026-0708

Plugin

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (surecart)

Affected

all versions before 4.9.4

Remediation

Update to 4.9.4 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-10

Attack surface

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments on WPSec AttackSurface

Fix released

2026-10-08

Published

2026-10-10

Description

The SureCart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'live_mode' parameter on the Invoices admin list in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping of the status filter links, which were printed inside a single-quoted href attribute without esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

References

• https://wpsec.com/vuln/WPSEC-2026-0708/
• https://plugins.svn.wordpress.org/surecart/tags/4.9.4/
• https://wordpress.org/plugins/surecart/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS