Low severity · published Oct 4, 2026
CVE-2026-104119
Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
3.5
CVSS
0.1%
EPSS
No
On KEV
Description
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Simple Shopping Cart ·
before 5.2.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104119
exploit
https://wpscan.com/vulnerability/d6ee7720-9c2d-48b3-b238-0da4fed398a3/
More from Simple Shopping Cart
5.3
CVE-2026-104641
Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
2.7
CVE-2026-104642
Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass