CVE-2026-109224: SureCart WordPress Plugin XSS Vulnerability

CVE-2026-109224 Overview

CVE-2026-109224 is a stored Cross-Site Scripting (XSS) vulnerability in the SureCart ecommerce plugin for WordPress. The flaw affects all versions up to and including 4.9.4. It stems from insufficient input sanitization and output escaping on the comment parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes when users load an affected page. Exploitation requires the comment to appear on a post that loads the surecart-components runtime, such as a page using the [sc_buy_button] shortcode without an sc-checkout element. These conditions route attacker-controlled input into the innerHTML sink inside sc-cart-loader. The vulnerability is tracked as [CWE-79].

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into SureCart-enabled WordPress pages, enabling session theft, administrative action hijacking, and arbitrary client-side code execution.

Affected Products

SureCart plugin for WordPress — all versions through 4.9.4
WordPress sites loading the surecart-components runtime via [sc_buy_button] shortcode
WordPress pages rendering SureCart comments without an sc-checkout element

Discovery Timeline

2026-10-16 - CVE-2026-109224 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109224

Vulnerability Analysis

The SureCart plugin registers block services that render user-supplied comment content on front-end pages. The plugin's KSES configuration permits attributes and elements that the sc-cart-loader component then injects into the DOM through an innerHTML assignment. Because the input is neither sanitized to strip executable payloads nor escaped at the output boundary, attacker-controlled markup executes in the browser context of any visitor to the page.

Exploitation does not require authentication. An attacker submits a crafted comment through the standard WordPress comment flow. When a visitor loads a post containing the [sc_buy_button] shortcode without an sc-checkout element, the loader processes the stored content and triggers the injection. The resulting script runs with the privileges of the visiting user, including administrators.

Root Cause

The root cause is a missing sanitization layer between stored comment content and the DOM sink in sc-cart-loader.entry.js. The plugin's kses.json allowlist (line 216) and the block service provider logic (lines 100 and 152 of BlockServiceProvider.php) permit markup that reaches innerHTML without escaping. See the WordPress SureCart Loader Script and the KSES allowlist for the vulnerable code paths.

Attack Vector

The attack vector is remote and network-based. An unauthenticated user posts a comment containing crafted HTML or JavaScript payloads to any post or page where comments are enabled. The payload persists in the WordPress database. When an administrator or customer later loads a SureCart-enabled page that satisfies the loader conditions, the stored payload executes in their browser. See the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2026-109224

Indicators of Compromise

Comment records in wp_comments containing <script>, onerror=, onload=, or other event-handler attributes.
Unexpected outbound requests from visitor browsers to attacker-controlled domains when loading SureCart product pages.
New or modified WordPress administrator accounts created shortly after an admin viewed a comment-enabled SureCart page.
Session cookies for administrator accounts observed in unfamiliar geographic locations.

Detection Strategies

Audit all stored comments on posts containing the [sc_buy_button] shortcode for HTML tags and JavaScript event handlers.
Deploy a Web Application Firewall (WAF) rule to inspect comment submissions for script tags and event-handler patterns.
Monitor web server logs for POST requests to /wp-comments-post.php containing encoded or raw HTML payloads.
Review browser Content Security Policy (CSP) violation reports for script execution originating from the WordPress origin.

Monitoring Recommendations

Enable WordPress audit logging for comment creation, approval, and administrator session activity.
Correlate failed and successful admin logins with recent visits to SureCart product pages.
Alert on changes to the surecart plugin files and the wp_options table outside of maintenance windows.

How to Mitigate CVE-2026-109224

Immediate Actions Required

Update the SureCart plugin to a version released after 4.9.4 that includes the fix referenced in the SureCart changeset.
Disable comments on posts containing SureCart shortcodes until the patch is applied.
Review and purge existing comment content on affected pages for malicious markup.
Rotate administrator credentials and invalidate active sessions if compromise is suspected.

Patch Information

The vendor has published a corrective changeset in the WordPress plugin repository. Site operators should upgrade through the WordPress admin plugin updater or by downloading the latest release directly from the plugin page. See the WordPress SureCart Changeset Overview for the committed fix.

Workarounds

Remove the [sc_buy_button] shortcode from pages that also permit comments.
Place an sc-checkout element on SureCart pages to bypass the vulnerable innerHTML code path.
Restrict comment submission to authenticated users via WordPress discussion settings.
Deploy a strict Content Security Policy (CSP) that disallows inline scripts on front-end pages.

bash

# Configuration example: disable comments site-wide via WP-CLI
wp option update default_comment_status closed
wp post list --post_type=page --format=ids | xargs -d ' ' -I % wp post update % --comment_status=closed