CVE-2026-118070 uscnanbu CVE debrief

Who should care

Defenders responsible for WordPress installations using the Welcart e-Commerce plugin, especially versions up to 2.12.5, should assess exposure and risk of arbitrary web script injection.

Why it matters

Defenders should prioritize verifying exposure of WordPress installations using the Welcart e-Commerce plugin, especially versions up to 2.12.5, and assess the risk of arbitrary web script injection.

• Possible injection of arbitrary web scripts in pages that will execute whenever a user accesses an injected page
• Potential for unauthenticated attackers to store malicious gid values in order metadata
• Risk of script execution when an administrator opens an injected order in the WordPress admin panel

Technical summary

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is staged by an unauthenticated visitor who forges the ROBOT PAYMENT browser-return request, storing the malicious gid value in order metadata.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Welcart e-Commerce plugin, especially versions up to 2.12.5, and assess the risk of arbitrary web script injection.

Recommended defensive actions

• Verify WordPress installations for the Welcart e-Commerce plugin version 2.12.5 or earlier
• Assess the risk of arbitrary web script injection
• Implement input sanitization and output escaping for the 'gid' parameter
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code. The vulnerability was publicly disclosed on 2026-10-31T07:16:36.007Z. The CVE record has not been modified since then. The NVD entry provides additional information on the vulnerability, including its severity and potential impact. The Welcart e-Commerce plugin is widely used in WordPress installations, and defenders should verify exposure of their installations to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.