SureCart vulnerabilities
We track 5 vulnerabilities in SureCart products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest SureCart vulnerabilities
- 8.1 High severity
SureCart – Ecommerce Made Easy For Selling…: Improper Authentication
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) reso
- 7.2 High severity
SureCart – Ecommerce Made Easy For Selling…: Improper Neutralization of Input During Web Page Generation
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4
- 7.2 High severity
SureCart – Ecommerce Made Easy For Selling…: Improper Neutralization of Input During Web Page Generation
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4
- 8.8 High severity
SureCart: Improper Privilege Management
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an a
- 8.1 High severity
SureCart – Ecommerce Made Easy For Selling…: Weak Password Recovery Mechanism for Forgotten Password
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer