Description

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T06:18:15.797Z",
  "pubdate": "2026-08-12T06:18:15.797Z",
  "executiveSummary": "An input sanitisation and output escaping vulnerability exists in the Welcart e-Commerce WordPress plugin before version 2.11.34.\nThe vulnerability allows authenticated users possessing the Author role and above to inject arbitrary web scripts into product fields.\nWhen visitors view the affected product pages, the malicious payload executes within the context of their browsers.\nThis Stored Cross-Site Scripting (XSS) flaw can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.\nExploitation requires administrative or author-level access to create or modify product entries within the WordPress environment.\nThe risk is mitigated by updating the Welcart e-Commerce plugin to version 2.11.34 or later, where proper sanitisation and escaping controls are implemented.",
  "technicalDetails": "The root cause of this vulnerability stems from the inadequate validation, sanitisation, and output escaping of user-supplied data within product fields handled by the Welcart e-Commerce plugin.\nSpecifically, when data submitted via product creation or modification interfaces is stored in the database and subsequently rendered on front-end product pages, it fails to undergo proper context-aware HTML entity encoding.\nAuthentication and privilege requirements dictate that an attacker must compromise or hold an account with the WordPress Author role or higher, granting them permissions to manage products.\nThe attack vector is network-based, operating through the standard HTTP/HTTPS request cycle used to interact with the WordPress administrative dashboard and public-facing product catalogs.\nThe step-by-step attack flow begins with the authenticated attacker navigating to the product creation or editing interface provided by the Welcart e-Commerce plugin.\nThe attacker then injects a malicious payload, such as a crafted script tag containing JavaScript, into a vulnerable product field.\nUpon submission, the input is processed and stored persistently within the underlying database without being neutralised.\nWhen an unsuspecting visitor or administrator requests the corresponding product page, the server retrieves the unescaped data and outputs it directly into the HTML document structure.\nThe victim's browser parses the HTTP response and executes the arbitrary script in the context of the victim's session.\nThe payload behavior can include stealing session cookies, redirecting the user to malicious external sites, or performing unauthorized administrative actions if the victim holds high privileges.\nThe affected component comprises the product handling and rendering logic of the Welcart e-Commerce plugin across all versions prior to 2.11.34."
}