CVE-2026-109224: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

CVE-2026-109224 describes a stored cross-site scripting vulnerability in the SureCart WordPress plugin up to version 4.9.4. The flaw arises from improper neutralization of input in the 'comment' parameter, leading to arbitrary script injection. Exploitation requires the injected comment to appear on a post that loads the surecart-components runtime (e.g., via the [sc_buy_button] shortcode) and lacks an sc-checkout element, triggering an innerHTML sink in sc-cart-loader. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

An unauthenticated attacker can inject arbitrary web scripts into pages viewed by users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality and integrity of user data. The vulnerability does not impact availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions or restrict exposure of pages that load surecart-components runtime with the specified shortcode conditions.