EUVD-2026-57086
GHSA-xgc5-xxmg-c9x4
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Author-level account required (PR:L), victim must actively visit the product page (UI:R), scope changes to victim browser context (S:C), no availability impact (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
AnalysisAI
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenticated user holding the Author role or above to permanently inject malicious JavaScript into product pages, executing in every subsequent visitor's browser. A publicly available proof-of-concept exploit exists and the EPSS score of 16% reflects above-average exploitation probability for a medium-severity plugin flaw. The vendor has released a fix in version 2.11.34, and patching is the primary recommended action.
Technical ContextAI
The vulnerability is a stored (persistent) Cross-Site Scripting flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected component, identified by CPE cpe:2.3:a:unknown:welcart_e-commerce:*:*:*:*:*:*:*:*, is a WordPress e-commerce plugin that processes product data for storefront rendering. The plugin fails to apply output encoding or HTML escaping to at least one product-related field prior to rendering it on the product page. Because the payload is stored in the database rather than reflected, it executes for every visitor who loads the affected page without requiring further action by the attacker after initial injection. WordPress's Author role is a low-privilege content-creation account, broadening the attacker pool beyond administrators in multi-author or marketplace-style deployments.
RemediationAI
Update the Welcart e-Commerce plugin to version 2.11.34 or later, which resolves the unsanitized product field output. The fix is available through the WordPress plugin repository and detailed in the WPScan advisory at https://wpscan.com/vulnerability/ed3b39a6-493c-490e-af41-c4d04992e19e/; NVD details are at https://nvd.nist.gov/vuln/detail/CVE-2026-16066. If immediate patching is not feasible, restrict assignment of the Author role and above to fully vetted and trusted accounts, eliminating the practical attacker pool at the cost of limiting contributor access. Additionally, audit existing product entries for unexpected script tags or encoded JavaScript payloads to detect any prior exploitation before applying the patch.
More in Welcart E Commerce
View allThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtnia
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have au
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usc
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on th
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holdi
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remot
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated r
Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. Rated high seve
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today