Brainstorm Force SureCart: Stored Cross-Site Scripting in WordPress plugin
Summary
The SureCart ecommerce plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.12.1. An attacker with a low-privilege account, such as a contributor, can store malicious scripts that run in the browsers of other users. Successful exploitation requires a privileged user to take an action, such as opening a crafted page or submitting a form.
Affected
- SureCart WordPress plugin from 0 through 4.12.1 (Brainstorm Force)
Fixed in
- Version 4.13.0 or later (according to the Patchstack CVE record; to be verified against the Patchstack advisory before rollout)
Workaround
- Unknown. No workaround is documented because a patch is available. Until the update is applied, restrict low-privilege accounts on the site.
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- Not listed in CISA KEV.
Our recommendation
- Inventory WordPress sites that run SureCart.
- Back up the sites and update SureCart to 4.13.0 or later after testing.
- Review user accounts with contributor or higher roles and recently stored content for suspicious scripts.
- Prioritise patching, as the plugin has had several other advisories in 2026.
- Note the CVSS score discrepancy: VulDB lists 3.5, while Patchstack and NVD-aligned sources list 6.5.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: SureCart XSS patchstack.com
- CVE Record CVE-2026-124411 www.cve.org
- VulDB CVE-2026-124411 vuldb.com
- OffSeq Radar CVE-2026-124411 radar.offseq.com
- Strix CVE-2026-124411 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:27.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.