{"id":"CVE-2026-119505","kind":"vulnerability","aliases":["CVE-2026-119505"],"related":[],"title":"Welcart e-Commerce WordPress plugin: stored XSS through version 2.12.6","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.6.","summary":"Welcart e-Commerce (usc-e-shop) fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker can plant script that runs in other users' browsers, including site administrators.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"usc-e-shop","fixed":["2.12.7"],"affected":"<= 2.12.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["ecommerce","package","welcart","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check Welcart e-Commerce (usc-e-shop). Versions 2.12.6 and earlier are affected; or run: wp plugin get usc-e-shop --field=version","fix":"Update Welcart e-Commerce to 2.12.7 or later (current release, 2 Nov 2026). The changelog lists several XSS escapes but does not name CVE-2026-119505, so confirm against Patchstack's entry.","status":"open","published_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:15+00:00","updated_at":"2026-11-09T10:26:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Welcart e-Commerce WordPress plugin: stored XSS through version 2.12.6","impact":"medium","summary":"Welcart e-Commerce (usc-e-shop) fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker can plant script that runs in other users' browsers, including site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","welcart","ecommerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in admin browsers, enabling account takeover","analyst_note":"Confirm the fixed version and which input or role triggers the stored XSS; check the NVD entry and Welcart's release notes.","how_to_check":"- Check the installed Welcart e-Commerce plugin version in the WordPress admin under Plugins.\n- Confirm whether the installed version is `2.12.6` or earlier.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Welcart e-Commerce (usc-e-shop) plugin at version 2.12.6 or earlier are affected. Stored XSS means a low-privileged input that gets saved and later rendered to other visitors or administrators can execute script; the sources do not say which input fields or roles are involved.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4552,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and which input or role triggers the stored XSS; check the NVD entry and Welcart's release notes.","search":"'-119505':14A,17A '-2026':13A,16A '2.12.6':11A,101C 'administr':65B 'affect':93C 'allow':46B,89C 'attack':53B 'browser':62B 'commerc':4A,33B,84C,97C 'cross':49B,75C 'cross-sit':48B,74C 'cve':12A,15A 'e':3A,20A,32B,36B,83C,87C,96C 'e-commerc':2A,31B,82C,95C 'ecommerc':22B 'fail':38B 'generat':43B,73C 'improp':66C 'includ':63B 'input':41B,69C 'issu':92C 'n/a':99C 'neutral':40B,67C 'packag':23B 'page':45B,72C 'plant':55B 'plugin':6A,28B 'run':58B 'script':51B,56B,77C 'shop':21A,37B,88C 'site':50B,64B,76C 'store':7A,47B,90C 'usc':19A,35B,86C 'usc-e-shop':18A,34B,85C 'user':61B 'version':10A 'vulner':78C 'web':44B,71C 'welcart':1A,24B,30B,80C,81C,94C 'wordpress':5A,25B,27B 'wordpress-plugin':26B 'xss':8A,29B 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Welcart e-Commerce (usc-e-shop) plugin at version 2.12.6 or earlier are affected. Stored XSS means a low-privileged input that gets saved and later rendered to other visitors or administrators can execute script; the sources do not say which input fields or roles are involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["usceshop"],"ptokens":["shop","usc"],"labels":["ecommerce","high","package","welcart","wordpress","wordpressplugin","xss"],"campaign_type":null,"search_a":"'-119505':14A,17A '-2026':13A,16A '2.12.6':11A 'commerc':4A 'cve':12A,15A 'e':3A,20A 'e-commerc':2A 'plugin':6A 'shop':21A 'store':7A 'usc':19A 'usc-e-shop':18A 'version':10A 'welcart':1A 'wordpress':5A 'xss':8A","search_b":"'administr':65B 'allow':46B 'attack':53B 'browser':62B 'commerc':33B 'cross':49B 'cross-sit':48B 'e':32B,36B 'e-commerc':31B 'ecommerc':22B 'fail':38B 'generat':43B 'includ':63B 'input':41B 'neutral':40B 'packag':23B 'page':45B 'plant':55B 'plugin':28B 'run':58B 'script':51B,56B 'shop':37B 'site':50B,64B 'store':47B 'usc':35B 'usc-e-shop':34B 'user':61B 'web':44B 'welcart':24B,30B 'wordpress':25B,27B 'wordpress-plugin':26B 'xss':29B","search_c":"'2.12.6':101C 'affect':93C 'allow':89C 'commerc':84C,97C 'cross':75C 'cross-sit':74C 'e':83C,87C,96C 'e-commerc':82C,95C 'generat':73C 'improp':66C 'input':69C 'issu':92C 'n/a':99C 'neutral':67C 'page':72C 'script':77C 'shop':88C 'site':76C 'store':90C 'usc':86C 'usc-e-shop':85C 'vulner':78C 'web':71C 'welcart':80C,81C,94C 'xss.this':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119505","severity":null,"published_at":"2026-11-09T10:17:06+00:00","modified_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119505:2269","url":"https://wordpress.org/plugins/usc-e-shop/","severity":null,"published_at":"2026-11-09T10:26:50+00:00","modified_at":"2026-11-09T10:26:50+00:00","first_seen_at":"2026-11-09T10:26:50+00:00","fetched_at":"2026-11-09T10:26:50+00:00","note":"web-cli out of credits; used WordPress.org page. 2.12.7 (2 Nov 2026) is current and its changelog lists many XSS escapes, but it does not cite this CVE, so the fix is inferred and not verified. Role/input not stated by any source read (Patchstack page for it not found). Nothing verified.","cites":["https://wordpress.org/plugins/usc-e-shop/","https://nvd.nist.gov/vuln/detail/CVE-2026-119505"]}],"documents":[{"id":106977,"url":"https://wordpress.org/plugins/usc-e-shop/","title":"Welcart e-Commerce - WordPress.org plugin page (changelog)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":106978,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119505","title":"NVD CVE-2026-119505","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}