Is CVE-2026-118070 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118070 being exploited in the wild.

How severe is CVE-2026-118070?

High severity, with a CVSS score of 7.2, published 31 October 2026.

Which products and versions are affected?

Welcart e-Commerce up to and including 2.12.5.

Is there a fix for CVE-2026-118070?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-118070 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118070?

Check whether you run Welcart e-Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118070: Welcart e-Commerce stored cross-site scripting via gid parameter

CVE-2026-118070 · Severity: high · CVSS 7.2 · Published 2026-10-31

Welcart is an e-commerce plugin for WordPress that allows online stores to process payments and manage orders. An unauthenticated attacker can inject malicious scripts into order records through a forged payment return request, which then execute with full privileges when a store administrator views that order in WordPress. This could allow attackers to steal administrator credentials, modify orders, or perform other malicious actions within the store.

Technologies: Welcart e-Commerce. Vendors: Welcart.

Quick answers

Is CVE-2026-118070 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118070 being exploited in the wild.
How severe is CVE-2026-118070?: High severity, with a CVSS score of 7.2, published 31 October 2026.
Which products and versions are affected?: Welcart e-Commerce up to and including 2.12.5.
Is there a fix for CVE-2026-118070?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118070 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118070?: Check whether you run Welcart e-Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Welcart plugin fails to properly sanitize and escape the 'gid' parameter, allowing stored cross-site scripting (XSS) attacks. An unauthenticated attacker can inject a malicious payload by forging a ROBOT PAYMENT browser-return request; the payload is stored in order metadata and executes in the admin context when an administrator opens the affected order. This requires no authentication, user interaction, or special network access.

Affected products

Welcart e-Commerce up to and including 2.12.5

Timeline

2026-10-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.