EUVD-2026-57086
GHSA-xgc5-xxmg-c9x4
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Author-level account required (PR:L), victim must actively visit the product page (UI:R), scope changes to victim browser context (S:C), no availability impact (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
AnalysisAI
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenticated user holding the Author role or above to permanently inject malicious JavaScript into product pages, executing in every subsequent visitor's browser. A publicly available proof-of-concept exploit exists and the EPSS score of 16% reflects above-average exploitation probability for a medium-severity plugin flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an account with the WordPress Author role or higher - Editor, Shop Manager, or Administrator - on the target site; unauthenticated exploitation is not possible per the CVSS PR:L vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) captures the key risk contours: network-accessible, low complexity, low-privilege attacker, mandatory victim interaction, changed scope, and limited confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with Author-level credentials logs into a vulnerable WordPress site running Welcart e-Commerce and edits a product, embedding a JavaScript payload into the unsanitized product field. The payload is stored in the database and executes silently in the browser of every visitor who subsequently navigates to that product page, enabling session cookie theft, credential harvesting via fake login overlays, or drive-by redirection to attacker-controlled infrastructure. … |
| Remediation | Update the Welcart e-Commerce plugin to version 2.11.34 or later, which resolves the unsanitized product field output. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Welcart E Commerce
View allThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtnia
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have au
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usc
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on th
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holdi
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated r
Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. Rated high seve
SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obt
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today