PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112221 Brainstorm Force CVE debrief

A Cross Site Scripting (XSS) vulnerability exists in the WordPress SureCart plugin from n/a through version 4.9.5. This issue, known as CVE-2026-112221, was published on 2026-10-21T14:00:12.692Z and last modified on 2026-10-21T17:19:12.758Z. The vulnerability allows for Stored XSS and has a CVSS score of 7.1, classified as HIGH. Defenders responsible for WordPress installations using the SureCart plugin, especially those with user-generated content or untrusted input, should assess exposure and implement compensating controls. The CVE record and source item provide details on the vulnerability, including its existence in SureCart plugin versions up to 4.9.5 and the CVSS score of 7.

Vendor
Brainstorm Force
Product
SureCart
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders responsible for WordPress installations using the SureCart plugin, especially those with user-generated content or untrusted input, should assess exposure and implement compensating controls.

Why it matters

CVE-2026-112221 is a high-severity vulnerability in the WordPress SureCart plugin that allows for Stored XSS. Defenders should assess exposure, implement compensating controls, and prioritize updates for affected versions.

  • Potential for user sessions to be hijacked or sensitive information to be stolen
  • Possible injection of malicious scripts into web pages viewed by other users
  • Risk of unauthorized actions being performed on behalf of authenticated users
  • Need for verification of plugin version and exposure to potential exploitation

Technical summary

The WordPress SureCart plugin has a Stored Cross Site Scripting (XSS) vulnerability from n/a through version 4.9.5. The vulnerability is due to improper neutralization of input during web page generation. This issue allows for Stored XSS and has a CVSS score of 7.1, classified as HIGH. The vulnerability can be exploited by injecting malicious scripts into web pages viewed by other users, potentially leading to user sessions being hijacked or sensitive information being stolen.

Defensive priority

Defenders should prioritize assessing exposure and implementing compensating controls for WordPress installations using SureCart plugin versions up to 4.9.5.

Recommended defensive actions

  • Assess exposure of WordPress installations using SureCart plugin versions up to 4.9.5
  • Implement compensating controls for affected versions
  • Monitor for potential exploitation attempts
  • Update to version 4.9.6 or later if available

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in SureCart plugin versions up to 4.9.5 and the CVSS score of 7.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112221 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112221

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112221 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112221

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.