An unauthenticated Cross Site Scripting (XSS) vulnerability (CWE-79) exists in SureCart versions <=4.3.2. This vulnerability enables an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to information disclosure, session hijacking, or other impacts related to script execution. The vulnerability does not require authentication and has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official fix information is provided in the data.

Successful exploitation allows an unauthenticated attacker to execute scripts in the context of users' browsers, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability affects users interacting with the vulnerable SureCart versions, enabling actions such as session hijacking or information theft via malicious script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or output encoding workarounds if feasible. Monitor vendor communications for updates on patches or official mitigations.