Stored Cross-Site Scripting in Welcart e-Commerce Plugin for WordPress

CVE-2025-10651

What is CVE-2025-10651?

The Welcart e-Commerce plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of the 'order_mail' setting. This vulnerability affects versions up to and including 2.11.22. Authenticated attackers with Editor-level permissions or higher can exploit this flaw by injecting arbitrary web scripts through the General Setting page. These scripts will execute when an administrator accesses the E-mail Setting page, potentially leading to unauthorized actions or data exposure.

References