CVE-2026-19914

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the custom order parameter in the guest checkout form. An attacker can inject arbitrary web scripts that execute when an administrator views the affected order within the WordPress admin panel.

Recommendations Update the Welcart e-Commerce plugin for WordPress to version 2.12.2 or later. As a temporary mitigation, restrict access to the guest checkout form or avoid viewing orders containing the custom order parameter until the update is applied.