Vulnerabilidad · Publicado 16/10/2026
El plugin SureCart para WordPress (versiones hasta 4.9.4) es vulnerable a Cross-Site Scripting (XSS) almacenado mediante sanitización insuficiente del parámetro 'comment', permitiendo a atacantes no autenticados inyectar código malicioso. Esta vulnerabilidad afecta directamente a tiendas en línea de México y Latinoamérica que utilizan este plugin para vender productos físicos, digitales y gestionar suscripciones, exponiendo datos de clientes y credenciales de pago.
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.
Score: 7.2/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-79
Publicado en NIST NVD.