---
id: "CVE-2026-119505"
page: "https://infrastack.ai/live/CVE-2026-119505"
kind: "vulnerability"
aliases: ["CVE-2026-119505"]
title: "Welcart e-Commerce WordPress plugin: stored XSS through version 2.12.6"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "usc-e-shop", "fixed": ["2.12.7"], "affected": "<= 2.12.6", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["ecommerce", "package", "welcart", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T10:17:06+00:00"
first_seen_at: "2026-11-09T10:25:48+00:00"
updated_at: "2026-11-09T10:26:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119505", "first_seen_at": "2026-11-09T10:25:48+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119505", "first_seen_at": "2026-11-09T10:26:50+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-119505", "https://wordpress.org/plugins/usc-e-shop/"]}]
exploit_sources: []
---

# Welcart e-Commerce WordPress plugin: stored XSS through version 2.12.6

Link for people: https://infrastack.ai/live/CVE-2026-119505 (this .md is for agents)

Welcart e-Commerce (usc-e-shop) fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker can plant script that runs in other users' browsers, including site administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:usc-e-shop affected <= 2.12.6 fixed 2.12.7

## How to check

In WordPress admin > Plugins, check Welcart e-Commerce (usc-e-shop). Versions 2.12.6 and earlier are affected; or run: wp plugin get usc-e-shop --field=version

## Fix

Update Welcart e-Commerce to 2.12.7 or later (current release, 2 Nov 2026). The changelog lists several XSS escapes but does not name CVE-2026-119505, so confirm against Patchstack's entry.

## Timeline

- 2026-11-09T10:25:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119505
- 2026-11-09T10:26:50+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-119505 — web-cli out of credits; used WordPress.org page. 2.12.7 (2 Nov 2026) is current and its changelog lists many XSS escapes, but it does not cite this CVE, so the fix is inferred and not verified. Role/input not stated by any source read (Patchstack page for it not found). Nothing verified.

## Documents

- [describes] NVD CVE-2026-119505 https://nvd.nist.gov/vuln/detail/CVE-2026-119505
- [fix] Welcart e-Commerce - WordPress.org plugin page (changelog) https://wordpress.org/plugins/usc-e-shop/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.6.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_