Welcart e-Commerce EUVD-2026-114609

Requires a WordPress site running Welcart e-Commerce version 2.12.5 or earlier with the ROBOT PAYMENT payment integration in use, because the payload is staged specifically through a forged ROBOT PAYMENT browser-return request that writes the attacker-controlled 'gid' value into order metadata. Staging the payload needs no authentication (PR:N). Execution is limited by a key precondition: a WordPress administrator must subsequently open the affected order in the admin panel for the stored script to fire - so impact depends on privileged-victim interaction and on the ROBOT PAYMENT flow being reachable, rather than firing automatically against all visitors.

This is a stored XSS (CWE-79) in the Welcart e-Commerce WordPress plugin, scored 7.2 (HIGH) by Wordfence with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - the changed scope (S:C) and dual C:L/I:L reflect that injected script executes in a WordPress administrator's browser/session rather than only the attacker's context. PR:N confirms the staging step is reachable by an unauthenticated attacker. Exploitation status: no CISA KEV listing and no PoC or exploit reference appears in the input, so this is 'no public exploit identified at time of analysis'; the only external report is the Wordfence threat-intel advisory, which is not working exploit code. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be stated. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a real but not top-tier priority. Conflicting signal worth verifying: the input vector carries UI:N, yet the description states the payload only fires 'when an administrator opens that order in the WordPress admin panel' - that is privileged-victim interaction, so the effective risk is gated by an admin viewing a maliciously-staged order; treat UI:N as optimistic and weigh the admin-interaction dependency when prioritizing. Overall: a genuine admin-targeting stored XSS that is unauthenticated to stage but conditioned on a specific payment integration and on admin interaction, rather than a wormable mass-exploitation issue.

An unauthenticated attacker forges the ROBOT PAYMENT browser-return request to a site running Welcart e-Commerce (<= 2.12.5) with a malicious 'gid' value, which is stored unsanitized in order metadata. When a store administrator later opens that order in the WordPress admin panel, the injected script executes in the admin's authenticated session, enabling actions such as session/cookie theft or admin-context requests. No public exploit code is identified in the available sources at time of analysis.