The vulnerability is an improper neutralization of input during web page generation, allowing attackers to store malicious script code that is later rendered by browsers. This stored cross‑site scripting can lead to theft of session cookies, defacement of the site, and unauthorized execution of arbitrary client‑side logic. The weakness resides in the plugin’s handling of user‑supplied content, primarily identified as CWE‑79.

WordPress sites that use the Welcart e‑Commerce plugin version 2.11.16 or earlier are impacted. The vendor is Welcart e‑Commerce (info@welcart). Any WordPress installation incorporating this plugin range is susceptible.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score of less than 1% reflects a low probability of widespread exploitation as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an attacker would need to inject content into the plugin via the user interface or an administrative form; upon successful injection, the script is executed in the browsers of any site visitor. Exploiting the flaw requires access to content editing capabilities or user‑generated input that the plugin fails to sanitize.