CVE-2026-96761: WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability

Q: Does exploiting this issue require an authenticated WordPress or Welcart account?

No. The vulnerability is rated PR:N, indicating no privileges are required for exploitation.

Q: Does a victim need to take any action for an attack to succeed?

Yes. The UI:R rating indicates that user interaction is required, such as causing a victim to access attacker-controlled or crafted content.

Q: What level of impact is indicated if exploitation succeeds?

The supplied vector rates confidentiality, integrity, and availability impact as low, and indicates scope may change (S:C).

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.

Affected Software

1 affected component

Welcart Welcart e-Commerce<=2.12.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Welcart e-Commerce plugin to a version that resolves this vulnerability.
Fixed in 2.12.4

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does exploiting this issue require an authenticated WordPress or Welcart account?

No. The vulnerability is rated PR:N, indicating no privileges are required for exploitation.

Does a victim need to take any action for an attack to succeed?

Yes. The UI:R rating indicates that user interaction is required, such as causing a victim to access attacker-controlled or crafted content.

What level of impact is indicated if exploitation succeeds?

The supplied vector rates confidentiality, integrity, and availability impact as low, and indicates scope may change (S:C).

CVE-2026-96761: WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploiting this issue require an authenticated WordPress or Welcart account?

Does a victim need to take any action for an attack to succeed?

What level of impact is indicated if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploiting this issue require an authenticated WordPress or Welcart account?

Does a victim need to take any action for an attack to succeed?

What level of impact is indicated if exploitation succeeds?