SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments vulnerabilities

Product

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

by surecart · last CVE Oct 31, 2026

CVEs

On KEV

8.1

Max CVSS

New 30D

Vulnerabilities3 In the news0 Timeline

Severity mix

Critical 0High 3Medium 0Low 0

Severity

All severities3 Critical0 High3 Medium0 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-7655	8.1	0%	Jul 11	SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook Affected: through 4.2.3
CVE-2026-107653 New	7.2	0%	Oct 31	SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments Affected: through 4.9.4
CVE-2026-109224	7.2	0%	Oct 16	SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment Affected: through 4.9.4