{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/welcart-e-commerce--2.12.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-118070"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Welcart e-Commerce (\u003c= 2.12.5)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress","cve-2026-118070"],"_cs_type":"advisory","_cs_vendors":["Welcart"],"content_html":"\u003cp\u003eThe Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'gid' parameter in all versions up to and including 2.12.5. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject malicious web scripts into order metadata. The script executes within the context of an administrator's browser when they access the compromised order details in the WordPress admin panel.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target WordPress site running a vulnerable version of the Welcart e-Commerce plugin.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a forged ROBOT PAYMENT browser-return request.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious JavaScript payload into the 'gid' parameter of the request.\u003c/li\u003e\n\u003cli\u003eThe Welcart plugin improperly sanitizes the 'gid' input and saves it into the order metadata within the WordPress database.\u003c/li\u003e\n\u003cli\u003eAn administrator logs into the WordPress dashboard and navigates to the compromised order page.\u003c/li\u003e\n\u003cli\u003eThe injected JavaScript payload executes in the administrator's browser session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the administrative context. This can lead to unauthorized actions performed on behalf of the administrator, session hijacking, or exfiltration of sensitive administrative information.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Welcart e-Commerce plugin to a version beyond 2.12.5 once a fix is available from the vendor.\u003c/li\u003e\n\u003cli\u003eUntil patched, restrict access to the ROBOT PAYMENT browser-return endpoint to trusted sources or disable the integration if not required.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities by restricting the sources from which scripts can execute.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:52:32Z","date_published":"2026-10-31T07:52:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-welcart-xss-bcb8d373/","summary":"The Welcart e-Commerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'gid' parameter, allowing unauthenticated attackers to execute arbitrary JavaScript in the administrative dashboard.","title":"Welcart e-Commerce: Stored Cross-Site Scripting (CVE-2026-118070)","url":"https://feed.craftedsignal.io/briefs/2026-10-welcart-xss-bcb8d373/"}],"language":"en","title":"CraftedSignal Threat Feed - Welcart E-Commerce (\u003c= 2.12.5)","version":"https://jsonfeed.org/version/1.1"}