CVE-2026-87091

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts through the IPN endpoint using the rel and option parameters. Because the endpoint lacks authentication, nonce validation, or signature verification, malicious payloads are stored and subsequently executed when an administrator views the settlement error log.

Recommendations Update the plugin to version 2.12.3 or later. Restrict access to the IPN endpoint to minimize the risk of exploitation.