SureCart versions up to and including 4.3.2 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. This flaw allows attackers to execute scripts in the context of a user's browser without needing authentication. The vulnerability is classified as CWE-79 and has a high severity rating.