Skip to content
PluginCanary

SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

by SureCart · 80,000+ active installs · Checked 3 Nov 2026
Healthy13 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 4.9.5.

81/ 100 Canary Score
Sub-scores for SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 4.9.5. Update to version 4.9.5 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 4.9.6. Update to version 4.9.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 20 Oct 2026, fixed in 4.9.6. Update to version 4.9.6 or later.20 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 20 Oct 2026, fixed in 4.9.6. Update to version 4.9.6 or later.20 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 19 Oct 2026, fixed in 4.9.6. Update to version 4.9.6 or later.19 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 19 Oct 2026, fixed in 4.9.5. Update to version 4.9.5 or later.19 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 4.9.5. Update to version 4.9.5 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 13 Oct 2026, fixed in 4.9.5. Update to version 4.9.5 or later.13 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 12 Oct 2026, fixed in 4.9.4. Update to version 4.9.4 or later.12 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 12 Oct 2026, fixed in 4.9.4. Update to version 4.9.4 or later.12 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 24 Sep 2026, fixed in 4.7.3. Update to version 4.7.3 or later.24 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 8 Sep 2026, fixed in 4.7.0. Update to version 4.7.0 or later.8 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 7 Sep 2026, fixed in 4.6.3. Update to version 4.6.3 or later.7 Sep 2026Evidence
  • InfoSEC-319 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master13 Jul 2022 to 13 Jul 2022, 1 commits
2winfactor20 Jul 2022 to 3 Nov 2026, 411 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
today
Releases, 24 months
120
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Q1 202425
Q2 202412
Q3 202410
Q4 202419
Q1 202515
Q2 202512
Q3 202511
Q4 202518
Q1 202614
Q2 202611
Q3 202617
Q4 20268

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Support

100% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments7.2<= 4.9.44.9.50
30 Oct 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover8.1<= 4.9.54.9.60
20 Oct 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.9.54.9.60
20 Oct 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Missing Authorization5.3<= 4.9.54.9.60
19 Oct 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.9.54.9.60
19 Oct 2026SureCart <= 4.9.4 - Unauthenticated Information Exposure5.3<= 4.9.44.9.50
15 Oct 2026SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment7.2<= 4.9.44.9.50
13 Oct 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.9.44.9.50
12 Oct 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Authenticated (Custom Role+) PHP Object Injection7.5<= 4.9.34.9.40
12 Oct 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.9.34.9.40
24 Sep 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.7.2 - Authenticated (Shop Worker+) Privilege Escalation6.3<= 4.7.24.7.30
8 Sep 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.7.0 - Unauthorized WordPress Account Creation5.3< 4.7.04.7.00
7 Sep 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.6.3 - Authenticated (Subscriber+) Arbitrary Account Email Takeover8.8< 4.6.34.6.30
6 Aug 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.6.2 - Missing Authorization5.3<= 4.6.24.6.30
10 Jul 2026SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook8.1<= 4.2.34.3.00
26 Jun 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.3.2 - Reflected Cross-Site Scripting6.1<= 4.3.24.3.30
25 Jun 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 4.2.24.2.30
20 May 2026SureCart <= 4.2.0 - Authenticated (Admin+) SQL Injection4.9<= 4.2.04.2.10
26 Mar 2026SureCart <= 4.0.2 - Missing Authorization4.3<= 4.0.24.0.30
28 Aug 2024SureCart <= 2.29.3 - Reflected Cross-Site Scripting6.1<= 2.29.32.29.40
29 Aug 2023SureCart <= 2.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings4.4<= 2.5.02.5.10

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.8 from 289 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star267
4 star4
3 star7
2 star1
1 star10

Momentum

80,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
4 May 202617,489
11 May 202640,760
18 May 202631,826
25 May 202626,812
1 Jun 20268,365
8 Jun 202625,653
15 Jun 202625,984
22 Jun 202610,495
29 Jun 202628,014
6 Jul 202613,837
13 Jul 202629,525
20 Jul 202630,988
27 Jul 202626,398
3 Aug 202631,841
10 Aug 202610,074
17 Aug 202645,603
24 Aug 202625,861
31 Aug 202641,669
7 Sep 202630,448
14 Sep 202629,475
21 Sep 202630,412
28 Sep 202642,793
5 Oct 202645,228
12 Oct 202644,403
19 Oct 202629,001
26 Oct 202628,468
2 Nov 20261,333

Weekly downloads over the last 4 weeks are 7% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Commerce7 for WordPressScore 91 · 1,000+External Store for ShopifyScore 87 · 2,000+Product Catalog SimpleScore 86 · 1,000+WooCommerceScore 85 · 7,000,000+Easy Digital Downloads - eCommerce Payments and Subscriptions made easyScore 85 · 40,000+

Facts

Version4.12.0
AuthorSureCart
Added20 Jul 2022
Last updated3 Nov 2026
Active installs80,000+
Requires WordPress6.8
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagsecommerce, online store, shopping cart, subscriptions, Recurring payments

Questions

Is SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments still maintained?

SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments was last updated on 3 Nov 2026. Its Canary status is Healthy.

Is SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments safe?

SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments has no open unpatched vulnerabilities on record. 19 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments?

The wordpress.org author is SureCart. Recent committers: 2winfactor, plugin-master. We have recorded no ownership change.

What can I use instead of SureCart - Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments?

Plugins in the same category with a higher Canary Score: Commerce7 for WordPress, External Store for Shopify, Product Catalog Simple, WooCommerce, Easy Digital Downloads - eCommerce Payments and Subscriptions made easy.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue