CVE-2026-104119
Received Received - Intake

Stored XSS in Simple Shopping Cart WordPress Plugin

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: WPScan

Description
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-104119
EUVD
EUVD-2026-92073

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
simple_shopping_cart 5.2.6 to 5.2.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Shopping Cart WordPress plugin before version 5.2.6. It occurs because the plugin does not escape certain settings field values before displaying them on an admin settings page. High-privilege users like administrators can inject malicious scripts, which are then stored and executed when other users view the page.

Detection Guidance

To detect this vulnerability, check the version of the Simple Shopping Cart WordPress plugin. If it is below 5.2.6, the system is vulnerable. Log in to the WordPress admin panel and navigate to Plugins to view the installed version.

Impact Analysis

An attacker with high privileges could inject malicious scripts into the plugin's settings. These scripts could steal sensitive data, perform actions on behalf of users, or deface the website. In multisite installations, administrators without the unfiltered_html capability are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR and HIPAA requirements for data protection and confidentiality. Stored XSS attacks may result in data breaches, triggering legal and financial penalties under these regulations.

Mitigation Strategies

Immediately update the Simple Shopping Cart plugin to version 5.2.6 or later. This can be done via the WordPress admin panel under Plugins. If updating is not possible, consider disabling the plugin until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart