Executive brief
Welcart is a widely-used e-commerce plugin for WordPress that enables online stores. An unauthenticated attacker can inject malicious JavaScript code through the guest checkout form, which executes when administrators view orders in the WordPress backend. This allows attackers to steal sensitive data, modify orders, or compromise administrative accounts without requiring any authentication.
Technical details
The Welcart e-Commerce plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'custom_order' parameter due to insufficient input sanitization and output escaping. The vulnerability is reachable via the guest checkout form, requiring no authentication to inject the malicious payload. When an administrator accesses the affected order in the WordPress admin panel, the injected JavaScript executes in the context of the admin session. An attacker can leverage this to perform arbitrary actions on behalf of administrators, including data exfiltration or privilege escalation. The vulnerability affects all versions up to and including 2.12.1; patches or mitigations should be applied immediately.
Affected products
- Eldar Welcart e-Commerce up to and including 2.12.1
Timeline
- 2026-09-01: disclosed