EUVD-2026-91910
GHSA-75wc-wvc7-9m96
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network injection via an open IPN endpoint gives AV:N/AC:L/PR:N; payload stored and auto-rendered to the admin justifies UI:N, and cross-privilege execution in the admin session gives S:C with C:L/I:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endpoint accepts the 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification, meaning any unauthenticated attacker can directly submit malicious payloads that are stored and later rendered in the administrator's settlement error log view.
AnalysisAI
Unauthenticated stored cross-site scripting in the Welcart e-Commerce plugin for WordPress (all versions up to and including 2.12.2) lets any remote attacker plant arbitrary JavaScript through the plugin's settlement/IPN notification endpoint, which accepts the 'rel' and 'option' parameters without authentication, nonce validation, or signature verification. Injected payloads are persisted and later rendered unsanitized inside the administrator's settlement error log view in wp-admin, where they execute in the admin's browser session (CVSS 3.1 score 7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and can be leveraged to hijack an authenticated administrator session or perform privileged actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Welcart e-Commerce plugin (versions through 2.12.2) is installed and its settlement/IPN notification endpoint is reachable, which it is by default since the endpoint accepts the 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely actionable issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update the Welcart e-Commerce plugin to a release containing upstream changeset 3690880 (https://plugins.trac.wordpress.org/changeset/3690880/usc-e-shop, which modifies trunk/functions/settlement_func.php), since that changeset is the only remediation reference supplied; the exact tagged release version that first ships this fix is not independently confirmed in the available data, so administrators should update to the latest available Welcart release and verify in the plugin changelog that the settlement function sanitization is included, treating version 2.12.2 and earlier as vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress instance running the Welcart e-Commerce plugin at version 2.12.2 or earlier using WP-CLI (wp plugin list --format=table) or your software inventory tooling, and treat each as exposed; simultaneously review the Welcart settlement error log view in wp-admin for injected script content, and force-reset all administrator credentials and active sessions, enabling multi-factor authentication for every admin account. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Welcart E Commerce
View allThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtnia
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have au
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usc
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenti
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on th
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holdi
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remot
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today