Skip to content
Sign in
3.5 Low

CVE-2026-104119 The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before…

Description

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

Affected products and versions

Product Affected versions Fixed in
Simple Shopping Cart 5.2 earliest → < 5.2.6 5.2.6

Other CVEs of Simple Shopping Cart

The 3 CVEs of Simple Shopping Cart →
CVE-2026-104642 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the… 2.7 Low CVE-2026-104641 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a… 5.3 Medium
Track this CVE