CVE-2026-19914: Welcart e-Commerce WordPress Plugin XSS

CVE-2026-19914 Overview

CVE-2026-19914 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Welcart e-Commerce plugin for WordPress in all versions up to and including 2.12.1. The flaw resides in the handling of the custom_order parameter, where the plugin fails to properly sanitize input and escape output. Unauthenticated attackers can inject arbitrary JavaScript through the guest checkout form. The payload executes when a WordPress administrator views the affected order in the admin panel, enabling session hijacking, privilege escalation, and administrative action abuse in the authenticated administrator context.

Critical Impact
Unauthenticated attackers can deliver stored JavaScript payloads that execute in the WordPress administrator's browser during routine order review.

Affected Products

Welcart e-Commerce plugin for WordPress, versions up to and including 2.12.1
Fixed in Welcart e-Commerce plugin version 2.12.2
WordPress sites operating the usc-e-shop plugin with guest checkout enabled

Discovery Timeline

2026-09-01 - CVE-2026-19914 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-19914

Vulnerability Analysis

The vulnerability is a stored XSS issue that spans the plugin's checkout-to-admin workflow. Attacker-controlled data enters through the public guest checkout form via the custom_order parameter. The plugin stores this data without sufficient sanitization and later renders it in the order edit form inside the WordPress admin panel without proper output escaping. When an administrator opens the affected order for review, the injected script executes in the administrator's authenticated session. Because the sink is an authenticated admin interface, an attacker can leverage the execution context to perform administrative actions, exfiltrate session cookies, create new privileged users, or pivot into further site compromise. The CVSS scope change reflects the impact crossing from an unauthenticated public form into the privileged admin origin.

Root Cause

The root cause is missing input sanitization on ingest and missing output escaping on render for the custom_order value. Relevant plugin code paths include classes/cart.class.php, functions/function.php, functions/utility.php, and includes/order_edit_form.php. The order edit form emits the stored value into the admin HTML context without applying WordPress escaping helpers such as esc_html() or esc_attr(). The fix was applied in changeset 3673344 and shipped in version 2.12.2.

Attack Vector

Exploitation requires no authentication and no user interaction beyond an administrator later reviewing the malicious order. An attacker submits the guest checkout form with a crafted custom_order value containing a JavaScript payload. The payload persists in the order record. When an administrator opens the order in the WordPress admin panel, the script executes with administrator privileges in the site origin. See the WordPress Plugin Order Edit Form and the Wordfence Vulnerability Report for source-level detail.

Detection Methods for CVE-2026-19914

Indicators of Compromise

Guest checkout submissions containing HTML tags, <script>, onerror, onload, or javascript: sequences in the custom_order field
Unexpected administrator account creation, role changes, or plugin installations following order review activity
Outbound requests from admin browser sessions to attacker-controlled domains shortly after opening an order
Anomalous WordPress admin session cookies observed on untrusted IP addresses

Detection Strategies

Inspect the WordPress database wp_usces_order and related order metadata tables for stored payloads containing script tags or event-handler attributes in custom_order
Deploy web application firewall rules to flag checkout submissions where custom_order contains HTML control characters such as <, >, or quoted attributes
Correlate administrator session activity with the time window immediately following order view events to identify script-driven admin actions

Monitoring Recommendations

Monitor WordPress admin panel access logs alongside order-view URLs matching wp-admin/admin.php?page=usces_orderlist
Alert on new administrator user creation, manage_options capability grants, and plugin or theme edits
Log and review Content Security Policy (CSP) violation reports from the /wp-admin/ origin

How to Mitigate CVE-2026-19914

Immediate Actions Required

Update the Welcart e-Commerce plugin to version 2.12.2 or later on all WordPress installations
Audit stored orders created before patching for malicious content in the custom_order field and sanitize or delete affected records
Review the WordPress user list for unauthorized administrator accounts and rotate credentials for existing administrators
Invalidate active WordPress admin sessions to revoke any tokens potentially stolen through exploitation

Patch Information

The vendor addressed the vulnerability in Welcart e-Commerce version 2.12.2. The fix is documented in Changeset 3673344 and the version diff from 2.12.1 to 2.12.2. Download the current version from the WordPress Plugin Directory.

Workarounds

Deploy a web application firewall rule that blocks or strips HTML and script content from the custom_order parameter on checkout endpoints
Restrict WordPress admin panel access to a defined list of source IP addresses using server or reverse-proxy access controls
Enforce a strict Content Security Policy on /wp-admin/ that disallows inline scripts to reduce payload execution success
Temporarily disable guest checkout in Welcart until patching is complete

bash

# Nginx location rule to block script-like content in custom_order (temporary mitigation)
location = /wp-content/plugins/usc-e-shop/ {
    if ($arg_custom_order ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
}