CVE-2025-9367: Welcart e-Commerce WordPress XSS Vulnerability

CVE-2025-9367 Overview

CVE-2025-9367 is a Stored Cross-Site Scripting (XSS) vulnerability in the Welcart e-Commerce plugin for WordPress. The flaw affects all plugin versions up to and including 2.11.20. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's settings handlers. Authenticated attackers with editor-level permissions or higher can inject arbitrary web scripts into pages. Those scripts execute whenever a visitor loads an affected page. The issue only impacts WordPress multi-site installations and single-site installations where the unfiltered_html capability has been disabled. It is tracked under CWE-79.

Critical Impact
Editor-level users on multi-site WordPress deployments can persist JavaScript payloads that execute in the browsers of all page visitors, enabling session theft, account takeover, and administrative action forgery.

Affected Products

Welcart e-Commerce (usc-e-shop) plugin for WordPress, versions <= 2.11.20
WordPress multi-site installations running the affected plugin
Single-site WordPress installations where unfiltered_html has been disabled

Discovery Timeline

2025-09-10 - CVE-2025-9367 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-9367

Vulnerability Analysis

The Welcart e-Commerce plugin exposes settings fields that accept user-supplied values without applying adequate sanitization. The plugin also fails to escape those values when rendering them back into page output. An authenticated user at editor privilege or above can submit crafted input containing HTML or JavaScript. The payload is stored in the plugin configuration and later written into rendered pages verbatim. Any browser that loads the affected page executes the injected script in the context of the WordPress origin.

Stored XSS in an e-commerce context is high-value for attackers. Injected scripts can harvest administrator session cookies, submit forged requests against WordPress REST endpoints, or redirect shoppers to attacker-controlled checkout flows. The vendor addressed the issue in a code change recorded in the WordPress Plugin Code Changeset.

Root Cause

The root cause is a combination of missing input sanitization on write and missing output escaping on render inside classes/usceshop.class.php. Expected WordPress sanitization primitives such as sanitize_text_field() and output helpers such as esc_html() or esc_attr() were not applied to the affected settings values. As a result, raw markup supplied by an authenticated user is persisted and later emitted into page HTML.

Attack Vector

Exploitation requires an authenticated session with editor-level or higher privileges. The attacker navigates to the Welcart settings area and submits a payload containing script content in a vulnerable field. The payload is stored by the plugin and later rendered to any user who loads a page that includes the injected setting. Because privilege requirements are met by editors, the vulnerability is only materially impactful where editors are not trusted to run arbitrary HTML. That corresponds to WordPress multi-site installations and installations where unfiltered_html has been disabled, since trusted single-site setups already grant editors that capability by default.

No code example is published for this issue. Review the vendor patch in the referenced plugin changeset for the specific fields and escaping functions involved.

Detection Methods for CVE-2025-9367

Indicators of Compromise

Welcart plugin settings records containing <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload=.
Unexpected outbound requests from visitor browsers to third-party domains after loading pages that render Welcart content.
WordPress audit log entries showing settings updates by editor-level accounts that do not normally modify store configuration.
New or modified administrator accounts created shortly after an editor session interacted with Welcart settings.

Detection Strategies

Query the WordPress wp_options table for Welcart option keys and scan values for HTML tags or JavaScript event handlers.
Inspect rendered store pages with a headless browser and flag any inline <script> content that does not match known plugin templates.
Correlate editor-level logins with subsequent writes to plugin configuration endpoints under /wp-admin/admin.php?page=usces_*.

Monitoring Recommendations

Enable WordPress audit logging for role and settings changes, and alert on edits to Welcart configuration pages.
Monitor Content Security Policy (CSP) violation reports for inline script execution on store pages.
Track plugin version inventory across multi-site networks and alert when any site runs usc-e-shop <= 2.11.20.

How to Mitigate CVE-2025-9367

Immediate Actions Required

Update the Welcart e-Commerce plugin to a version later than 2.11.20 on all WordPress sites.
Audit editor-level accounts on multi-site networks and remove unused or over-privileged users.
Review Welcart settings values for stored HTML or script content and remove any unexpected payloads.
Rotate administrator session cookies and reset credentials if injected content is discovered.

Patch Information

The maintainers patched the vulnerability in the plugin source. The fix is published as the WordPress Plugin Code Changeset. Additional context is available on the USC E-Shop Plugin Developer Info page and in the Wordfence Vulnerability Report #829facc1. Install any plugin release that incorporates changeset 3357586 or later.

Workarounds

Restrict access to Welcart settings pages to administrators only using a role management plugin until the patch is applied.
On multi-site deployments, grant unfiltered_html only to vetted super administrators and limit editor assignments.
Deploy a Web Application Firewall (WAF) rule that blocks requests to Welcart settings endpoints containing <script, onerror=, or javascript: tokens.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on store-facing pages.

bash

# Example: WP-CLI inventory to locate vulnerable installs across a multi-site network
wp site list --field=url | while read site; do
  version=$(wp plugin get usc-e-shop --field=version --url="$site" 2>/dev/null)
  if [ -n "$version" ]; then
    echo "$site usc-e-shop $version"
  fi
done