CVE-2026-87091: Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endpoint accepts the 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification, meaning any unauthenticated attacker can directly submit malicious payloads that are stored and later rendered in the administrator's settlement error log view.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated remote attacker can submit malicious values to the IPN endpoint. Exploitation does not require an account, a nonce, or a valid signature.
Which deployments are affected?
Welcart e-Commerce for WordPress versions through 2.12.2 are affected. The vulnerable behavior is in the settlement-notification handling path that accepts the rel and option parameters.
When does the injected script execute?
The payload is stored and later rendered in the administrator's settlement error log view. It executes when a user accesses the injected page, including an administrator reviewing that log.
Is a default protection present on the IPN endpoint?
No authentication, nonce validation, or signature verification is performed for the rel and option parameters described. An exposed endpoint can therefore accept attacker-supplied payloads directly.