XSS Vulnerability in Welcart e-Commerce by Welcart
CVE-2026-119503

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Welcart E-commerce
Vendor
CVE Published:
9 November 2026

What is CVE-2026-119503?

The Welcart e-Commerce plugin suffers from a security vulnerability that allows for code injection due to improper handling of script-related HTML tags. This weakness poses a risk to users as it can be exploited to execute potentially harmful scripts. Affected versions include all versions prior to 2.12.6, highlighting the need for immediate updates to ensure that the platform remains secure against unauthorized code execution.

Affected Version(s)

Welcart e-Commerce 0 <= 2.12.6

References

https://patchstack.com/database/wordpress/plugin/usc-e-sh...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

xwashira | Patchstack Bug Bounty Program
.