EUVD-2026-68997
GHSA-g3pg-45c8-ww54
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R reflects that an administrator must view the injected order to trigger execution; all other metrics align with unauthenticated network delivery and changed scope into the admin browser context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is delivered via the guest checkout form, requiring no authentication, and executes when an administrator views the affected order in the WordPress admin panel.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions up to and including 2.12.1) allows unauthenticated attackers to inject arbitrary JavaScript via the guest checkout form's 'custom_order' parameter. The payload is persisted in the WordPress database without sanitization and fires inside the WordPress admin panel when an administrator reviews the affected order - a routine operational workflow requiring no social engineering of the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required from the attacker - the injection point is the guest checkout form, available to any site visitor without an account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) correctly identifies zero authentication barrier on input and a Changed Scope impact - but the UI:N rating is debatable: while the attacker requires no user interaction to submit the payload, execution depends on an administrator viewing the order, which CVSS guidance typically scores as UI:R from the victim's perspective. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Welcart e-Commerce plugin to version 2.12.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: deactivate and remove the Welcart plugin, or immediately implement Web Application Firewall rules to block access to guest checkout functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Welcart E Commerce
View allThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtnia
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have au
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usc
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenti
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on th
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holdi
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remot
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today