medium5.4
CVE-2026-16066
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users wi…
Impact
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
Affected products
| Product | Affected versions |
|---|---|
| Welcart E-Commerce WordPress Plugin | before 2.11.34 |
Versions were read from the advisory text. No structured product data has been published for this record yet.