Welcart e-Commerce: Stored Cross-Site Scripting (CVE-2026-118070)

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'gid' parameter in all versions up to and including 2.12.5. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject malicious web scripts into order metadata. The script executes within the context of an administrator's browser when they access the compromised order details in the WordPress admin panel.

Attack Chain

1. Attacker identifies a target WordPress site running a vulnerable version of the Welcart e-Commerce plugin.
2. Attacker initiates a forged ROBOT PAYMENT browser-return request.
3. Attacker injects a malicious JavaScript payload into the 'gid' parameter of the request.
4. The Welcart plugin improperly sanitizes the 'gid' input and saves it into the order metadata within the WordPress database.
5. An administrator logs into the WordPress dashboard and navigates to the compromised order page.
6. The injected JavaScript payload executes in the administrator's browser session.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the administrative context. This can lead to unauthorized actions performed on behalf of the administrator, session hijacking, or exfiltration of sensitive administrative information.

Recommendation

• Upgrade the Welcart e-Commerce plugin to a version beyond 2.12.5 once a fix is available from the vendor.
• Until patched, restrict access to the ROBOT PAYMENT browser-return endpoint to trusted sources or disable the integration if not required.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities by restricting the sources from which scripts can execute.