---
id: CVE-2026-104119
title: >-
  The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of
  its settings field values before outputting them on an admin settings page,
  allowing high-privilege users such as administrators to perform Stored
  Cross-Site …
summary: >-
  The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of
  its settings field values before outputting them on an admin settings page,
  allowing high-privilege users such as administrators to perform Stored
  Cross-Site …
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-79
product: Simple Shopping Cart
affected:
  - simple_shopping_cart < 5.2.6
published: '2026-10-04'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T15:18:12.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104119'
references:
  - url: 'https://wpscan.com/vulnerability/d6ee7720-9c2d-48b3-b238-0da4fed398a3/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00142
epssPercentile: 0.03525
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-05T10:51:01.022351Z'
ingestedAt: '2026-10-04T06:55:02.310Z'
---

## Overview

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.