5.4
Medium
CVE-2026-16066 The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting…
Description
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Welcart e-Commerce 2.11 | earliest → < 2.11.34 | 2.11.34 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Welcart e-Commerce
The 16 CVEs of Welcart e-Commerce →
CVE-2026-111031
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a…
4.7
Medium
CVE-2026-111032
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted…
3.8
Low
CVE-2026-111027
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using…
6.8
Medium
CVE-2025-15671
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and…
5.4
Medium