Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
CVE-2026-104119
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104119
Simple Shopping Cart
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Simple Shopping Cart",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.2.6",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-104119
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #8547 · Revision 1
- Added to Heist Feed
- Publisher date