CVE-2026-104119: CWE-79 Cross-Site Scripting (XSS) in Simple Shopping Cart

The Simple Shopping Cart WordPress plugin versions prior to 5.2.6 do not escape certain settings field values before rendering them on an administrative settings page. This flaw enables stored Cross-Site Scripting (CWE-79) attacks by high-privilege users, including administrators. The vulnerability is especially significant in multisite environments where administrators do not have the unfiltered_html capability, potentially allowing malicious script injection that persists in the admin interface.

High-privilege users can inject and store malicious scripts that execute in the context of the admin settings page. This can lead to unauthorized actions within the WordPress admin environment, potentially compromising site integrity or user data. The impact is heightened in multisite installations where administrators have restricted HTML capabilities, increasing the risk of persistent XSS exploitation.

Upgrade the Simple Shopping Cart plugin to version 5.2.6 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated. Since the plugin is not a cloud service, remediation depends on applying the official plugin update.