CVE-2026-119503: WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerability

Q: Which installations are affected?

Welcart e-Commerce versions through 2.12.6 are affected. The available data does not identify a version where the issue is fixed.

Q: Does exploitation require authentication or user interaction?

The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected security impact?

The issue is rated medium severity at 6.5 and is assessed as having low integrity and availability impact, with no confidentiality impact.

Published Nov 9, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6.

Affected Software

1 affected component

Welcart Welcart e-Commerce<=2.12.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Welcart e-Commerce to a version that resolves this vulnerability.
Fixed in 2.12.7

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Welcart e-Commerce versions through 2.12.6 are affected. The available data does not identify a version where the issue is fixed.

Does exploitation require authentication or user interaction?

The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected security impact?

The issue is rated medium severity at 6.5 and is assessed as having low integrity and availability impact, with no confidentiality impact.

CVE-2026-119503: WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the expected security impact?