Description

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is delivered via the guest checkout form, requiring no authentication, and executes when an administrator views the affected order in the WordPress admin panel.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-01T10:17:12.843Z",
  "pubdate": "2026-09-01T10:17:12.843Z",
  "executiveSummary": "The Welcart e-Commerce plugin for WordPress, in versions up to and including 2.12.1, contains a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization and output escaping within the 'custom_order' parameter.\nThe vulnerability allows unauthenticated remote attackers to inject malicious JavaScript payloads via the guest checkout form. When an administrator accesses the compromised order details within the WordPress dashboard, the payload executes within the context of their session.\nThe impact is critical, as it facilitates unauthorized script execution in the administrative interface. This can lead to administrative account takeover, unauthorized actions performed on behalf of the administrator, or the exfiltration of sensitive site data.\nBecause exploitation requires no prior authentication, the threat profile is significant for all public-facing e-commerce sites utilizing the affected versions. Mitigation requires updating the plugin to a version where these sanitization and escaping mechanisms have been properly implemented.",
  "technicalDetails": "The vulnerability resides in the order processing logic of the Welcart plugin, specifically involving the 'custom_order' parameter. The core issue is an improper handling of user-supplied data during the submission of the guest checkout form. The application fails to perform adequate input validation or sanitization before storing the 'custom_order' data into the WordPress database.\nFurthermore, when this stored data is retrieved and rendered in the WordPress admin panel for order management, the application fails to utilize secure output encoding. This creates a Stored XSS vector where malicious scripts persist in the backend database.\nThe exploitation flow is straightforward: An attacker identifies the guest checkout process where the 'custom_order' parameter is submitted. Instead of legitimate order information, the attacker crafts an HTTP request containing a malicious JavaScript payload injected into the 'custom_order' field. The plugin accepts this input and persists it directly into the database associated with the order entry.\nThe payload remains dormant until an administrator navigates to the 'Order List' or the specific 'Order Detail' page within the WordPress administrative dashboard. Upon loading the view, the application serves the malicious script to the administrator's browser without escaping, causing the browser to execute the injected code within the authenticated administrative session.\nBecause the payload executes in the browser of a privileged user (the administrator), the malicious script inherits the administrator's security context. This allows the attacker to bypass standard client-side security controls. Potential post-exploitation activities include the theft of session cookies, the creation of new rogue administrative accounts, the injection of additional backdoors into theme or plugin files, or the redirection of administrative traffic to external malicious domains.\nThis vulnerability affects Welcart versions up to and including 2.12.1. It is accessible over the network without any authentication or specific privilege requirements, making it an attractive target for automated vulnerability scanning and opportunistic exploitation against e-commerce installations."
}