CVE-2025-10651

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions through 2.11.22

Description The Welcart e-Commerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the order mail setting. Insufficient sanitization of the order mail field and a lack of output escaping allow authenticated attackers with Editor-level permissions or higher to inject arbitrary web scripts via the General Setting page. These scripts will execute when an administrator accesses the E-mail Setting page.

Recommendations Update the Welcart e-Commerce plugin to a version later than 2.11.22.