surecart has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.2 (high).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Products
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 1
- surecart 1
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
surecart vulnerabilities
CVEs affecting surecart, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-109224High· 7.2SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to…
▾ Twilightsurecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Paymentsvia CVEORG
CVE-2026-97245High· 7.2Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
▾ TwilightSureCart · surecartEPSS 0.34%via NVD