What is the CVSS score of CVE-2026-27539?

CVE-2026-27539 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Welcart e-Commerce are affected by CVE-2026-27539?

Welcart e-Commerce WordPress plugin versions through 2.11.31 contain an unauthenticated script injection vulnerability that allows attackers to steal customer and admin session credentials without…

How to fix or mitigate CVE-2026-27539?

Within 24 hours: audit all WordPress installations for Welcart plugin versions ≤2.11.31 and review admin/transaction logs for unauthorized access or payments. Within 7 days: disable the Welcart plugin or restrict it to trusted administrators only; deploy Web Application Firewall rules to block JavaScript injection attempts targeting the plugin. Within 30 days: monitor Welcart's official security advisories for a patch release and upgrade to the corrected version immediately upon availability.

Welcart e-Commerce CVE-2026-27539

EUVD-2026-57937 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-845x-v9mv-jq7m

WordPress XSS Welcart E Commerce Wordpress Plugin Welcart

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS crosses browser security context (S:C, C:L, I:L); A:N assessed as availability impact is not a typical or confirmed outcome of XSS here.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:03 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Welcart e-Commerce WordPress plugin (versions up to and including 2.11.31) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking an admin or authenticated customer into interacting with a crafted URL. The changed scope in the CVSS vector (S:C) confirms the payload executes outside the application's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this accessible to broad attacker populations.

Technical ContextAI

Welcart e-Commerce (WordPress plugin slug: usc-e-shop) is a Japanese-market WordPress e-commerce solution providing shopping cart, product management, and checkout functionality as an alternative to WooCommerce. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is rendered in an HTML response without sufficient sanitization or output encoding, allowing script injection. The affected CPE is cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:*:*:*, encompassing all plugin versions through 2.11.31. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C indicates this is most consistent with a reflected XSS pattern - a crafted URL parameter triggers the unsanitized output - though stored XSS cannot be excluded from the available description alone.

RemediationAI

Update the Welcart e-Commerce plugin beyond version 2.11.31 to the vendor-released patched version. The exact fixed version number is not independently confirmed in the provided data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/usc-e-shop/vulnerability/wordpress-welcart-e-commerce-plugin-2-11-31-cross-site-scripting-xss-vulnerability?_s_id=cve or the WordPress plugin repository for the confirmed safe release. If immediate patching is not feasible, deploy a WAF rule to sanitize or block reflected script payloads in HTTP request parameters processed by the plugin; note that aggressive WAF rules filtering angle brackets or script keywords may cause false positives on legitimate product search or form input. Additionally, enforce Content Security Policy (CSP) headers on the WordPress site to restrict inline script execution, which can limit XSS impact even if the injection point is triggered.