CVE-2026-104119

Name of the Vulnerable Software and Affected Versions Simple Shopping Cart WordPress plugin versions prior to 5.2.6

Description Stored Cross-Site Scripting (XSS) occurs because the plugin fails to escape certain settings field values before they are displayed on the admin settings page. This allows high-privilege users, such as administrators, to execute malicious scripts. The issue is particularly significant in multisite installations where administrators lack the unfiltered html capability, which normally prevents the execution of unfiltered HTML and scripts.

Recommendations Update Simple Shopping Cart WordPress plugin to version 5.2.6 or later.