CVE-2026-109697: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Brainstorm Force SureCart

This vulnerability in Brainstorm Force SureCart allows an attacker with limited privileges to inject malicious scripts that are stored and later executed in users' browsers when viewing affected pages. The issue is due to improper sanitization of input during web page generation, leading to stored XSS. The affected versions are all SureCart releases from initial versions up to 4.9.4 inclusive. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, user interaction, and impacts confidentiality, integrity, and availability at a low to medium level.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to data theft, session hijacking, or other malicious actions. The impact is limited by the requirement for attacker privileges and user interaction, but the vulnerability affects confidentiality, integrity, and availability to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Brainstorm Force communications for updates. Until a fix is available, limit privileges of users who can input data and consider applying web application firewall rules to detect and block XSS payloads.