CVE-2025-10651: Welcart e-Commerce XSS Vulnerability

CVE-2025-10651 Overview

CVE-2025-10651 is a Stored Cross-Site Scripting (XSS) vulnerability in the Welcart e-Commerce plugin for WordPress. The flaw affects all versions up to and including 2.11.22. The vulnerability stems from insufficient sanitization of the order_mail field and missing output escaping on the E-mail Setting page. Authenticated users with Editor-level permissions or higher can inject arbitrary web scripts through the General Setting page. These scripts execute when an administrator visits the E-mail Setting page, enabling actions in the administrator's browser context. The weakness is tracked as CWE-79.

Critical Impact
An Editor-level attacker can store malicious JavaScript that executes in an administrator's session, enabling account takeover, privilege escalation, or persistent backdoor installation on the WordPress site.

Affected Products

Welcart e-Commerce plugin for WordPress — versions up to and including 2.11.22
WordPress sites running the vulnerable usc-e-shop plugin
Administrator accounts that access the E-mail Setting page on affected installations

Discovery Timeline

2025-10-22 - CVE-2025-10651 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-10651

Vulnerability Analysis

The Welcart e-Commerce plugin exposes an order_mail configuration field on the General Setting page. The plugin accepts input from this field without applying adequate sanitization. The same value is later rendered on the E-mail Setting page without proper output escaping. An attacker with Editor-level access can submit a payload containing JavaScript into the order_mail field. The payload persists in the WordPress database and executes when an administrator opens the configuration screen. Because the script runs in the administrator's authenticated browser context, the attacker inherits the administrator's permissions for the duration of execution.

Root Cause

The vulnerability results from two combined coding defects. First, the plugin does not sanitize the order_mail input server-side to strip or neutralize HTML and script content. Second, the stored value is echoed into the E-mail Setting admin page without applying esc_attr(), esc_html(), or an equivalent WordPress escaping function. This dual failure — missing input sanitization and missing output escaping — allows script tags and event handlers to persist and execute.

Attack Vector

Exploitation requires an authenticated account with Editor permissions or higher. The attacker navigates to the Welcart General Setting page in the WordPress admin interface. The attacker submits a malicious payload in the order_mail field. The payload is stored in WordPress options and rendered on the E-mail Setting page the next time an administrator visits it. The attacker does not require user interaction beyond the administrator opening the configuration page as part of normal site management.

The vulnerability manifests through missing calls to WordPress sanitization and escaping APIs around the order_mail setting. See the WordPress plugin changeset for the vendor's patch and the Wordfence vulnerability report for technical analysis.

Detection Methods for CVE-2025-10651

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handlers stored in the Welcart order_mail WordPress option.
Administrator sessions generating outbound requests to unknown domains immediately after loading the Welcart E-mail Setting page.
Unauthorized creation of new administrator accounts or modification of user roles following access to Welcart settings pages.
WordPress audit log entries showing Editor-level users modifying Welcart General Setting values outside normal workflows.

Detection Strategies

Query the wp_options table for the Welcart order_mail entry and inspect the value for HTML or script content.
Deploy a web application firewall rule to inspect POST requests to Welcart admin endpoints for XSS payload patterns.
Review WordPress activity logs for Editor accounts accessing or modifying the Welcart General Setting page.
Monitor browser Content Security Policy (CSP) violation reports from the WordPress admin interface.

Monitoring Recommendations

Enable a WordPress security audit plugin to capture changes to plugin configuration options.
Centralize WordPress and web server logs into a SIEM for correlation of admin-page access with suspicious outbound traffic.
Alert on changes to WordPress user roles and capabilities following Welcart configuration modifications.

How to Mitigate CVE-2025-10651

Immediate Actions Required

Update the Welcart e-Commerce plugin to a version later than 2.11.22 as published in the vendor advisory.
Audit all WordPress user accounts and remove Editor-or-higher privileges from users who do not require them.
Inspect the current Welcart order_mail setting value and remove any stored HTML, JavaScript, or event handler content.
Reset credentials for administrator accounts that may have loaded the compromised E-mail Setting page.

Patch Information

The vendor addressed the vulnerability in the plugin update referenced in the Welcart update announcement and committed in WordPress plugin changeset 3374769. The patch adds proper sanitization on input and escaping on output for the order_mail field. Site operators should upgrade through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict Editor-level and higher accounts to trusted personnel until the patched plugin version is deployed.
Deploy a web application firewall with XSS filtering rules in front of the WordPress admin interface.
Apply a strict Content Security Policy on the WordPress admin area to block inline script execution.
Temporarily disable the Welcart plugin if patching cannot be completed and e-commerce functionality is not business-critical.

bash

# Update the Welcart plugin via WP-CLI
wp plugin update usc-e-shop

# Verify the installed version
wp plugin get usc-e-shop --field=version

# Inspect the stored order_mail option for injected content
wp option get usc_welcart_settings | grep -i order_mail