USC-E-SHOP · CVE-2026-119505 · Package
FIX → 2.12.7
Welcart e-Commerce (usc-e-shop) fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker can plant script that runs in other users' browsers, including site administrators.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Welcart e-Commerce (usc-e-shop) plugin at version 2.12.6 or earlier are affected. Stored XSS means a low-privileged input that gets saved and later rendered to other visitors or administrators can execute script; the sources do not say which input fields or roles are involved.
Not affected if plugin-not-installed
Who cares ecommerce, welcart, wordpress, wordpress-plugin, xss
2.12.6 and earlier are affected; or run: wp plugin get usc-e-shop --field=versionUpgrade to 2.12.7
2.12.7 or later (current release, 2 Nov 2026)Posts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.