CVE-2026-16066

MEDIUM CVSS 5.4 View on NVD ↗

Description

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/ed3b39a6-493c-490e-af41-c4d04992e19e/

Published: Aug 12, 2026 06:18 UTC Modified: Aug 12, 2026 17:17 UTC