CVE-2026-104119
Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
CVSS Score
3.5
EPSS Score
0.2%
EPSS Percentile
4th
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
| Vendor | unknown |
| Product | simple shopping cart |
| Published | Oct 4, 2026 |
| Last Updated | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown simple shopping cart
Be the first to know when new low vulnerabilities affecting unknown simple shopping cart are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Simple Shopping Cart
0 < 5.2.6
References
Credits
Krugov Artyom WPScan