CVE-2026-104119 — Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privileg…
Published: 2026-10-04 · CVSS: 3.5 · CVSS 3.1
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7