EUVD-2026-95612
GHSA-xwmr-jph7-fcqj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS is network-reachable with no attacker privileges (PR:N) but needs victim interaction (UI:R); payload runs in the browser so scope changes (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.
AnalysisAI
Reflected cross-site scripting (CWE-79) in the Welcart e-Commerce WordPress plugin (usc-e-shop) affects all versions up to and including 2.12.3, allowing a remote unauthenticated attacker to inject script that executes in a victim's browser session. Exploitation depends on user interaction (UI:R): an attacker must lure a user - realistically a logged-in WordPress administrator or shop operator - into clicking a crafted link or visiting a page that reflects the malicious parameter, at which point the injected script can act with that user's privileges and, per the CVSS scope change (S:C), potentially affect resources beyond the vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to lure a user - realistically a logged-in Welcart/WordPress administrator or shop operator - into clicking a crafted link or visiting a page that triggers the reflected parameter (UI:R is the primary limiting factor). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a reflected cross-site scripting (CWE-79) flaw in the Welcart e-Commerce (usc-e-shop) WordPress plugin, affecting all versions up to and including 2.12.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was confirmed from the available input data, so the first action is to check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/usc-e-shop/vulnerability/wordpress-welcart-e-commerce-plugin-2-12-3-cross-site-scripting-xss-vulnerability?_s_id=cve and the plugin's WordPress.org changelog for a release above 2.12.3, then upgrade the usc-e-shop plugin to that version - noting that a version newer than 2.12.3 is implied by an advisory titled against 2.12.3 but is not independently confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using the Welcart e-Commerce plugin (usc-e-shop) at versions up to and including 2.12.3, and if business-critical, temporarily disable the plugin or restrict wp-admin access to trusted IPs; enable web application firewall (WAF) rules targeting reflected cross-site scripting (CWE-79) and review logs for suspicious admin requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Welcart E Commerce
View allThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtnia
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have au
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usc
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenti
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on th
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holdi
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remot
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today