CVE-2026-119505: WordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerability

Q: Does an attacker need an account to exploit this issue?

No. The CVSS vector indicates network-based exploitation with no privileges required, although it requires user interaction.

Q: What security impact is indicated if exploitation succeeds?

The assigned vector indicates low impacts to confidentiality, integrity, and availability, with a changed scope.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.6.

Affected Software

1 affected component

Welcart Welcart e-Commerce<=2.12.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Welcart e-Commerce usc-e-shop to a version that resolves this vulnerability.
Fixed in 2.12.7

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need an account to exploit this issue?

No. The CVSS vector indicates network-based exploitation with no privileges required, although it requires user interaction.

What security impact is indicated if exploitation succeeds?