Stored Cross-Site Scripting in Welcart e-Commerce Plugin

The Welcart e-Commerce plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-19914. The flaw exists in the 'custom_order' parameter, which fails to properly sanitize input or escape output during the guest checkout process. Versions up to and including 2.12.1 are affected. An unauthenticated attacker can supply a crafted script within the checkout form fields. When a site administrator navigates to the WordPress dashboard to review the processed order, the malicious script executes in their browser session. This can be leveraged to perform unauthorized administrative actions, steal session tokens, or redirect users to malicious domains, posing a significant risk to the integrity of the WordPress environment.

Impact

The vulnerability poses a high risk to WordPress installations using the Welcart plugin, specifically impacting administrative accounts. Successful exploitation allows for the execution of arbitrary scripts, potentially leading to full site compromise if an administrator session is hijacked. Given the nature of e-commerce plugins, this could result in unauthorized order modifications or the theft of sensitive administrative or customer data.

Recommendation

Prioritized actions for security and IT teams:

• Update the Welcart e-Commerce plugin to the latest version beyond 2.12.1 immediately to patch CVE-2026-19914.
• Implement a Web Application Firewall (WAF) to inspect POST requests to the guest checkout endpoint for common XSS patterns, specifically targeting the 'custom_order' parameter.
• Audit administrative access logs for unusual activity originating from the plugin's order management pages.
• Review the WordPress admin panel for any injected malicious scripts in order descriptions or custom order fields.