Stored Cross-Site Scripting Vulnerability in Welcart e-Commerce Plugin for WordPress

CVE-2026-118070

What is CVE-2026-118070?

The Welcart e-Commerce plugin for WordPress is susceptible to stored cross-site scripting attacks through the 'gid' parameter across all versions up to and including 2.12.5. This vulnerability arises from inadequate input validation and output escaping mechanisms, allowing unauthenticated attackers to inject malicious scripts into pages. These crafted scripts execute when an administrator views an order containing the compromised gid value, thereby jeopardizing site integrity and user data. Proper remediation measures should be implemented to ensure the security and functionality of the plugin.

References