What is GHSA-p57v-42f3-wfqr?

GHSA-p57v-42f3-wfqr is a security advisory published by GitHub Security Advisories with unknown severity. The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field...

Which CVE IDs does GHSA-p57v-42f3-wfqr cover?

GHSA-p57v-42f3-wfqr covers the following CVE IDs: CVE-2026-104119. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-p57v-42f3-wfqrunknown

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field...

Vendor

GitHub Security Advisories

Published

October 4, 2026

Last Modified

October 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-104119 →

📋 Description

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-104119
https://wpscan.com/vulnerability/d6ee7720-9c2d-48b3-b238-0da4fed398a3
https://github.com/advisories/GHSA-p57v-42f3-wfqr