CVE-2026-16066 in Welcart e-Commerce Plugin
Summary
by MITRE • 08/12/2026
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability exists within the Welcart e-Commerce WordPress plugin version 2.11.34 and earlier, where insufficient input sanitization and output escaping mechanisms fail to properly handle product field data before rendering it on public-facing product pages. This flaw represents a classic cross-site scripting vulnerability that allows authenticated users with the Author role or higher privileges to inject malicious scripts into product content, which then executes in the browsers of all visitors who view those product pages. The issue stems from the plugin's failure to implement proper sanitization routines when processing product field inputs, creating an attack vector where malicious actors can leverage their elevated permissions to compromise the browsing experience of other users.
This vulnerability falls under CWE-79 - Cross-site Scripting and aligns with ATT&CK technique T1566.001 - Phishing via Social Engineering, as it enables attackers to craft malicious product content that can be used for various social engineering campaigns. The security impact extends beyond simple script execution, as these payloads could potentially redirect users to malicious sites, steal session cookies, or perform other malicious actions on behalf of the victim. Attackers with Author privileges can exploit this by creating or modifying product entries containing malicious JavaScript code within fields such as product descriptions, titles, or custom attributes that are displayed on public pages.
The operational impact of this vulnerability is significant for WordPress sites utilizing the Welcart plugin, as it provides attackers with a persistent means of executing malicious code against visitors without requiring additional privileges or complex attack vectors. Once exploited, the injected scripts execute in the context of the victim's browser session, potentially enabling full theft of user sessions, credential harvesting, or redirection to phishing sites. The vulnerability affects all visitors who access product pages containing the malicious content, making it a scalable threat that can impact large numbers of users simultaneously.
Mitigation strategies should include immediate upgrade to Welcart plugin version 2.11.34 or later, which addresses this specific sanitization issue through proper input validation and output escaping mechanisms. Administrators should also implement additional security measures such as role-based access controls to limit the ability of Authors and lower privileged users to inject potentially harmful content into product fields. Regular monitoring of product content for suspicious script injections and implementation of Content Security Policies can provide additional layers of protection against exploitation of similar vulnerabilities in other parts of the WordPress ecosystem.