CVE-2026-104119

LOWCVSS 3.5

Description

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

Timeline

Published:October 4th, 2026 7:16 AM

Last modified:October 5th, 2026 11:16 AM

CVSS Scoring

CVSS v3: 3.5 (LOW)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/d6ee7720-9c2d-48b3-b238-0da4fed398a3/

Source: NIST NVD · Data may lag official sources by up to one minute