Security Alert Summary
The Welcart e-Commerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the custom_order parameter that affects all versions up to and including 2.12.1. An unauthenticated attacker can submit a malicious payload via the guest checkout form that will be stored and executed when an administrator views the affected order in the WordPress admin interface. The issue is caused by insufficient input sanitization and output escaping.
CVE Details
- CVE ID: CVE-2026-19914
- Affected component: Welcart e-Commerce plugin for WordPress
- Affected versions: All versions up to and including 2.12.1 (“less than or equal to 2.12.1”)
- Published: September 1, 2026 at 10:17:12 AM
- Last modified: September 1, 2026 at 4:16:55 PM
- CVSS v3.1: Base Score 7.2, Severity HIGH, Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: No authentication required (PR:N), no user interaction required (UI:N)
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue that stems from insufficient input sanitization and output escaping of the custom_order parameter. The attack vector is the guest checkout form: an unauthenticated attacker can submit a crafted value for the custom_order field which is persisted by the plugin.
When an administrator views the affected order in the WordPress admin panel, the stored payload is rendered and executes in the administrator’s browser context. The CVE references plugin files involved in order handling and rendering (for example, includes/order_edit_form.php and other referenced files), which indicates the data is being displayed in admin order pages without sufficient escaping.
Impact is limited to actions available in the administrator’s browser session (for example, viewing the order). The issue does not by itself require authentication to introduce the payload, but execution occurs when an admin user views the injected content.
How This Could Impact Your Website
Consider a scenario where a customer completes a guest checkout and supplies a value in a custom order field. An attacker could use that field to store a script that runs when a site administrator or staff member opens the order in the admin area. This could allow the attacker to read data available in the administrator’s session context or perform actions that the admin browser can perform, depending on what the injected script does.
Practical consequences include exposure of internal user information visible to administrators (for example, order-related data or email addresses shown on the order screen) and an increased risk of targeted phishing or social engineering against staff who access order details. External contractors or contributors who have access to order screens could also be exposed.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and other low-privilege accounts that can access order details.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and admin logins for unusual behavior, and review recent orders for unexpected content in custom fields.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.11.34/classes/cart.class.php#L552
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.11.34/functions/function.php#L228
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.11.34/functions/utility.php#L1548
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.11.34/includes/order_edit_form.php#L233
- https://plugins.trac.wordpress.org/changeset/3673344/usc-e-shop/trunk/includes/order_edit_form.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fusc-e-shop/tags/2.12.1&new_path=%2Fusc-e-shop/tags/2.12.2
- https://wordpress.org/plugins/usc-e-shop/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/527630bf-d034-4fcd-8fbe-01b388701049?source=cve
