CVE-2026-109224

{
  "etk_id": "ETK-2026-1995",
  "cve_id": "CVE-2026-109224",
  "display_id": "CVE-2026-109224",
  "ghsa_id": "GHSA-ppfv-pcr2-7cv3",
  "euvd_id": "EUVD-2026-102822",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in SureCart for WordPress",
  "summary": "SureCart for WordPress through version 4.9.4 can store attacker-supplied script through its comment handling and execute it in a visitor's browser. Exploitation requires the affected content to be shown on a page that loads the SureCart component runtime but does not include a checkout component.",
  "mitigation": "Update SureCart to version 4.9.5 or later. Until the update is deployed, restrict untrusted submission of the affected comment content and review pages that load SureCart components without checkout elements.",
  "vendor": "surecart",
  "product": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.9.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0028,
  "epss_percentile": 0.1926,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 39.939015866666665,
  "t0_at": "2026-10-16T08:27:42.175000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T18:09:49.531002+00:00",
      "days": 2.4042518055787037,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T08:27:42.175000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T08:27:42.175000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T08:27:42.175000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109224"
    }
  }
}