UNKNOWN NVD

CVE-2026-104119

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allow

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

References

https://wpscan.com/vulnerability/d6ee7720-9c2d-48b3-b238-0da4fed398a3/

Published: 2026-10-04 · Source: NVD · Feed updated: 2026-10-04

This unknown severity vulnerability was published on 2026-10-04 via NVD.

vulnfeed aggregates 10551 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.