Executive brief
Welcart e-Commerce is a WordPress plugin that enables online product sales and inventory management. The plugin fails to sanitize product names, allowing users with author-level permissions to inject malicious scripts that execute in the browsers of all site visitors, including administrators. This could lead to account compromise, malware distribution, or data theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the product name field (CWE-79). The root cause is insufficient input sanitization and output escaping when rendering product information on public pages, widget displays, and email notifications. An authenticated user with the Author role (or above) can inject arbitrary JavaScript into the product name during product creation; this payload is stored unsanitized in the database and executed in the browser of any unauthenticated visitor accessing the product page or related widgets. The vulnerability affects multiple output contexts: the product page body, the "Items recommended" widget, the og:title meta tag, and HTML order confirmation emails. The fix was applied in version 2.11.34.
Affected products
- Elhe Inc. Welcart e-Commerce before 2.11.34
Timeline
- 2026-08-12: disclosed: CVE-2026-16066 published
- 2026-08-12: patched: Fixed in version 2.11.34