Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-104119: Simple Shopping Cart lets admin inject malicious code
CVE-2026-104119 · published 15 days ago
Summary
The Simple Shopping Cart plugin for WordPress (versions before 5.2.6) fails to properly clean up data entered on its settings page. This lets users with admin rights place hidden code that runs whenever the page is viewed, especially on multisite sites. Update the plugin to version 5.2.6 or later to stop this behavior.
What to do
- Update unknown simple shopping cart to version 5.2.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | simple shopping cart | < 5.2.6 |
Original advisory text
Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.5
Low
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta