CVE-2026-112241Critical· 9.8▾ MidnightAuthentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
surecart <= 4.9.5Update the WordPress SureCart plugin to the latest available version (at least 4.9.6).
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112221High· 7.1WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
CVE-2026-108073Medium· 5.3SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
CVE-2026-112840Medium· 6.5WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
CVE-2026-105874High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
CVE-2026-106599High· 8.8Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
CVE-2026-109697Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.