medium4.7
CVE-2026-111031
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers t…
Impact
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.
Affected products
| Product | Affected versions |
|---|---|
| Welcart E-Commerce WordPress Plugin | before 2.12.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.