5.4
Moyenne
CVE-2026-16066 The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting…
Description
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Welcart e-Commerce 2.11 | premières → < 2.11.34 | 2.11.34 |
Autres CVE de Welcart e-Commerce
Les 16 CVE de Welcart e-Commerce →
CVE-2026-111031
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a…
4.7
Moyenne
CVE-2026-111032
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted…
3.8
Faible
CVE-2026-111027
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using…
6.8
Moyenne
CVE-2025-15671
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and…
5.4
Moyenne