CVE-2026-87091: Welcart e-Commerce Plugin XSS Vulnerability

CVE-2026-87091 Overview

The Welcart e-Commerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its Instant Payment Notification (IPN) endpoint. The flaw affects all plugin versions up to and including 2.12.2. Unauthenticated attackers can submit malicious payloads through the rel and option parameters, which the plugin stores without sanitization. The payloads later execute when an administrator views the settlement error log in the WordPress admin interface. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can inject arbitrary JavaScript that executes in an administrator's browser session, enabling account takeover, privilege abuse, and persistent site compromise.

Affected Products

Welcart e-Commerce plugin for WordPress, all versions through 2.12.2
WordPress sites running the usc-e-shop plugin with the settlement/IPN feature enabled
Administrator interfaces that render the settlement error log view

Discovery Timeline

2026-10-03 - CVE-2026-87091 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-87091

Vulnerability Analysis

The Welcart e-Commerce plugin exposes an IPN endpoint used by payment gateways to deliver settlement notifications. The endpoint processes two request parameters, rel and option, and writes their values into the plugin's settlement error log when conditions warrant. The plugin does not sanitize these inputs on the way in, and it does not escape them on the way out when the administrator views the log in wp-admin. The result is a persistent XSS primitive reachable without authentication.

Because the payload is stored and later rendered in an administrator context, an attacker can execute JavaScript with the privileges of the viewing admin. This enables session theft, forced creation of new administrator accounts, plugin or theme modification, and persistent backdoors in the WordPress installation.

Root Cause

The root cause is insufficient input validation and missing output escaping in the IPN handler within functions/settlement_func.php and the related hook logic in functions/hoock_func.php. The affected code paths accept the rel and option values directly from the request and later emit them into HTML without applying esc_html(), esc_attr(), or equivalent WordPress escaping functions. See the WordPress Changeset Overview for the committed fix.

Attack Vector

The attack is network-reachable and requires no authentication, no nonce, and no gateway signature verification. An attacker sends a crafted HTTP request to the IPN endpoint with JavaScript payloads supplied through the rel and option parameters. The plugin stores the values in the settlement error log. The payload fires the next time a WordPress administrator opens the settlement error log view, executing attacker-controlled script in the admin's authenticated session.

No verified public proof-of-concept code is published. See the Wordfence Vulnerability Report and the referenced source lines in settlement_func.php at L569 for the vulnerable code paths.

Detection Methods for CVE-2026-87091

Indicators of Compromise

HTTP requests to the Welcart IPN endpoint containing rel or option parameters with <script>, onerror=, onload=, javascript:, or encoded script fragments.
Entries in the Welcart settlement error log containing HTML or JavaScript syntax rather than expected numeric or identifier values.
Unexpected creation of new WordPress administrator accounts, modified user roles, or new plugin installations following admin visits to the settlement log.
Outbound requests from admin browsers to unfamiliar domains shortly after loading wp-admin pages related to Welcart settlement.

Detection Strategies

Inspect web server access logs for POST or GET requests to the usc-e-shop IPN endpoint carrying script-like content in rel and option.
Deploy WAF rules that flag HTML tags, event handlers, and URL-encoded script payloads in requests targeting WordPress plugin endpoints.
Review the plugin's stored settlement error log directly in the database for records that contain <, >, or &# sequences.

Monitoring Recommendations

Alert on WordPress admin sessions that trigger outbound HTTP requests to domains not on an allow list.
Monitor wp_users and wp_usermeta tables for unexpected privilege changes or new accounts.
Track plugin file integrity under wp-content/plugins/usc-e-shop/ to identify tampering after suspected admin compromise.

How to Mitigate CVE-2026-87091

Immediate Actions Required

Update the Welcart e-Commerce plugin to the version released in changeset 3690880, which is the fixed release following 2.12.2.
Audit the settlement error log and purge entries containing HTML or script content.
Review WordPress administrator accounts and revoke any that were not provisioned by legitimate administrators.
Rotate administrator passwords and invalidate active sessions after confirming the patch is applied.

Patch Information

The vendor addressed the vulnerability in the commit tracked by WordPress Settlement Function Changes. The fix adds input validation and output escaping to the rel and option parameters processed by the IPN handler. Site operators should install the patched release from the official WordPress plugin repository.

Workarounds

Restrict access to the Welcart IPN endpoint at the web server or WAF layer so that only legitimate payment gateway source IP ranges can reach it.
Deploy a WAF signature that blocks requests to the usc-e-shop IPN endpoint containing HTML tags or JavaScript event handlers in rel or option.
Temporarily disable the Welcart plugin on sites that do not require active settlement processing until the patched release is deployed.

bash

# Example nginx rule to block script-like payloads in IPN parameters
location ~* /\?.*usc-e-shop {
    if ($args ~* "(rel|option)=[^&]*(<|%3C|script|onerror|onload|javascript:)") {
        return 403;
    }
}