{"id":"CVE-2026-119503","kind":"vulnerability","aliases":["CVE-2026-119503"],"related":[],"title":"Welcart e-Commerce WordPress plugin: stored script injection through web pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6.","summary":"Welcart e-Commerce (usc-e-shop) versions up to 2.12.6 fail to neutralize script-related HTML tags in a web page. An attacker can inject code that runs in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Welcart e-Commerce","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["e-commerce","other","welcart","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Welcart e-Commerce plugin version against the affected range (through `2.12.6`)","fix":null,"status":"open","published_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:23+00:00","updated_at":"2026-11-09T10:26:23+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T10:26:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Welcart e-Commerce WordPress plugin: stored script injection through web pages","impact":"medium","summary":"Welcart e-Commerce (usc-e-shop) versions up to 2.12.6 fail to neutralize script-related HTML tags in a web page. An attacker can inject code that runs in other users' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","welcart","e-commerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"injected script runs in visitors' browsers on the store","analyst_note":"Confirm the fixed version and the input that triggers the injection from the Welcart advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119503.","how_to_check":"- Check the installed Welcart e-Commerce plugin version against the affected range (through `2.12.6`)\n- unknown for other checks","plain_action":"","product_name":"Welcart e-Commerce","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Welcart e-Commerce (usc-e-shop) at or below 2.12.6 are in the affected range. The sources do not say which page inputs or roles are needed to trigger the injection. Sites not running this plugin can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4562,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119503':15A,18A '-2026':14A,17A '2.12.6':40B,101C 'affect':93C 'allow':89C 'attack':54B 'basic':76C 'browser':63B 'code':57B,90C 'commerc':4A,25B,32B,84C,97C 'commerce':22A 'cve':13A,16A 'e':3A,21A,24B,31B,35B,83C,87C,96C 'e-commerc':2A,23B,30B,82C,95C 'e-commerce':20A 'fail':41B 'html':47B,70C 'improp':64C 'inject':9A,56B 'injection.this':91C 'issu':92C 'n/a':99C 'neutral':43B,65C 'page':12A,52B,75C 'plugin':6A 'relat':46B,69C 'run':59B 'script':8A,45B,68C 'script-rel':44B,67C 'shop':36B,88C 'store':7A 'tag':48B,71C 'usc':34B,86C 'usc-e-shop':33B,85C 'user':62B 'version':37B 'vulner':78C 'web':11A,51B,74C 'welcart':1A,19A,27B,29B,80C,81C,94C 'wordpress':5A,28B 'xss':77C","nicknames":[],"mitigations":[],"who_affected":"Sites running Welcart e-Commerce (usc-e-shop) at or below 2.12.6 are in the affected range. The sources do not say which page inputs or roles are needed to trigger the injection. Sites not running this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ecommerce","welcartecommerce"],"ptokens":["commerce","welcart"],"labels":["ecommerce","medium","other","vendor","welcart","wordpress"],"campaign_type":null,"search_a":"'-119503':15A,18A '-2026':14A,17A 'commerc':4A 'commerce':22A 'cve':13A,16A 'e':3A,21A 'e-commerc':2A 'e-commerce':20A 'inject':9A 'page':12A 'plugin':6A 'script':8A 'store':7A 'web':11A 'welcart':1A,19A 'wordpress':5A","search_b":"'2.12.6':40B 'attack':54B 'browser':63B 'code':57B 'commerc':25B,32B 'e':24B,31B,35B 'e-commerc':23B,30B 'fail':41B 'html':47B 'inject':56B 'neutral':43B 'page':52B 'relat':46B 'run':59B 'script':45B 'script-rel':44B 'shop':36B 'tag':48B 'usc':34B 'usc-e-shop':33B 'user':62B 'version':37B 'web':51B 'welcart':27B,29B 'wordpress':28B","search_c":"'2.12.6':101C 'affect':93C 'allow':89C 'basic':76C 'code':90C 'commerc':84C,97C 'e':83C,87C,96C 'e-commerc':82C,95C 'html':70C 'improp':64C 'injection.this':91C 'issu':92C 'n/a':99C 'neutral':65C 'page':75C 'relat':69C 'script':68C 'script-rel':67C 'shop':88C 'tag':71C 'usc':86C 'usc-e-shop':85C 'vulner':78C 'web':74C 'welcart':80C,81C,94C 'xss':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119503","severity":null,"published_at":"2026-11-09T10:17:06+00:00","modified_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}