CVE-2026-118070 in Welcart E-Commerce Plugin
Summary
by MITRE • 10/31/2026
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is staged by an unauthenticated visitor who forges the ROBOT PAYMENT browser-return request, storing the malicious gid value in order metadata; the script then fires when an administrator opens that order in the WordPress admin panel.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The Welcart e-Commerce plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 2.12.5. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, which arises from insufficient input sanitization and output escaping mechanisms within the application code. The specific vector of exploitation involves the 'gid' parameter, which serves as an identifier in transactional data structures. Because the vulnerability allows for persistent storage of malicious payloads directly into the database via order metadata, it poses a significant risk to both site administrators and potentially other users who interact with the affected pages.
The technical mechanism behind this exploit relies on the manipulation of browser-return requests associated with ROBOT PAYMENT processing workflows. An unauthenticated attacker can forge these specific HTTP requests to inject arbitrary web scripts into the system. When such a forged request is processed, the malicious content contained within the 'gid' parameter is not properly validated or encoded before being written to the database. Consequently, this data becomes part of the order metadata stored in the WordPress backend. The vulnerability does not require any form of authentication for initial exploitation, allowing anyone on the internet with knowledge of the endpoint structure to attempt injection attacks against the target site.
The operational impact is realized when a privileged user, typically an administrator or shop manager, accesses the compromised order details within the WordPress admin panel. Upon rendering this page, the browser interprets the stored malicious script as legitimate code and executes it in the context of the authenticated session. This execution environment grants the attacker significant capabilities, including but not limited to stealing administrative cookies, hijacking sessions, performing actions on behalf of the administrator, or defacing the website interface. Since the payload is stored server-side, every subsequent view of that specific order by any authorized user triggers the malicious script, creating a persistent threat vector rather than a one-time occurrence.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents Stored XSS where the payload is saved on the target server and delivered to users later. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, particularly when used for client-side script execution like JavaScript. It also relates to T1132, Data Encoding, as attackers often encode payloads to bypass basic filters before storage. The lack of proper output encoding violates fundamental web security principles outlined in OWASP guidelines regarding the handling of user-supplied data in dynamic content generation.
To mitigate this vulnerability and protect against similar attacks, immediate action is required by site administrators. The primary remediation step is to update the Welcart e-Commerce plugin to a version newer than 2.12.5, where these sanitization and escaping issues have been addressed by the developers. Until an official patch is applied or if updating is not immediately feasible, temporary mitigations should be implemented at the web server level using Web Application Firewall rules that detect and block common XSS payloads in POST parameters related to payment gateways. Additionally, implementing strict Content Security Policy headers can help limit the impact of any successfully injected scripts by restricting script execution sources. Regular security audits and code reviews focusing on input validation and output encoding practices are essential for maintaining long-term resilience against such injection-based attacks.