CVE-2026-105874

Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in SureCart

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105874

EUVD

EUVD-2026-101011

Affected Vendors & Products

Vendor	Product	Version / Range
Brainstorm	Force	SureCart 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in the Brainstorm Force SureCart plugin. It occurs when user input is not properly neutralized during web page generation, allowing malicious scripts to be executed in a victim's browser. The vulnerability exists in versions up to and including 4.9.3.

Detection Guidance

To detect this reflected XSS vulnerability in SureCart, monitor web traffic for suspicious input patterns in URLs or form submissions. Check for unusual JavaScript execution in browser consoles when interacting with the application. Use tools like Burp Suite or OWASP ZAP to intercept and analyze HTTP requests for XSS payloads.

Impact Analysis

An attacker could exploit this to steal sensitive user data, hijack user sessions, or perform actions on behalf of users. Since it is a reflected XSS, the victim must interact with a crafted link or page for the attack to succeed.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update SureCart to the latest version (4.9.3 or later) to patch the vulnerability. If an update is unavailable, disable the SureCart plugin temporarily. Implement input validation and output encoding in web applications to prevent XSS attacks. Monitor for unusual activity in web server logs.

Hi! I’m here to help you understand CVE-2026-105874. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70