CVE-2026-16066

Deferred Deferred - Pending Action

Stored XSS in Welcart e-Commerce WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-16066

EUVD

EUVD-2026-57086

Affected Vendors & Products

Vendor	Product	Version / Range
welcart	welcart_e-commerce	to 2.11.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Welcart e-Commerce WordPress plugin before version 2.11.34. It occurs because the plugin does not properly sanitize or escape a product field before displaying it on product pages. This allows users with Author role or higher to inject malicious scripts that run in the browsers of visitors viewing the affected pages.

Detection Guidance

Check if the Welcart e-Commerce plugin version is below 2.11.34. Use WordPress admin dashboard or run: wp plugin list | grep welcart. Inspect product pages for unusual scripts in page source or browser console.

Impact Analysis

Attackers with Author role or higher could inject scripts to steal user data, session cookies, or perform actions on behalf of users. Visitors to compromised product pages may have their browsers hijacked, leading to malware downloads or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection. Organizations may face fines or legal consequences for failing to secure user data against such attacks.

Mitigation Strategies

Update the Welcart e-Commerce plugin to version 2.11.34 or later immediately. Remove or restrict Author role users' access until the update is applied. Monitor product pages for unexpected scripts.

Hi! I’m here to help you understand CVE-2026-16066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70