CVE-2026-107653

Name of the Vulnerable Software and Affected Versions SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments versions prior to 4.9.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts via the comment parameter. These scripts execute when a user accesses a page where the injected comment is visible and the SureCart web-component bundle is loaded, such as a page containing a SureCart Buy Button block. Execution depends on the comment being auto-approved or approved by a moderator.

Recommendations Update SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments to version 4.9.5 or later.