CVE-2026-19914

CVE-2026-19914 is a stored cross-site scripting flaw in the Welcart e-Commerce WordPress plugin, affecting all versions up to and including 2.12.1, caused by insufficient input sanitization and output escaping of the 'custom_order' parameter. An unauthenticated attacker submits a malicious payload through the guest checkout form, which is stored with the order. The injected script then executes whenever an administrator views that order in the WordPress admin panel, allowing the attacker to run arbitrary web scripts in an admin's browser session. Any WordPress site running Welcart e-Commerce at or below 2.12.1 with guest checkout available is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and ENHANCED EPSS places the 30-day exploitation probability at about 0.5%.

What to do: Update Welcart e-Commerce to the latest release (any version after 2.12.1) as soon as possible. Until patched, consider disabling or restricting guest checkout and review recently placed guest orders for unexpected HTML or script content in the 'custom_order' data before opening them in the admin panel.