Vendor

Welcart

1 brief RSS

Stored Cross-Site Scripting in Welcart e-Commerce Plugin

An unauthenticated stored XSS vulnerability in the Welcart e-Commerce WordPress plugin (CVE-2026-19914) allows attackers to inject malicious scripts that execute in the context of administrative sessions.

PoC Welcart e-Commerce web-vulnerability xss wordpress cve-2026-19914

1r 1t 1c 1h ago