The vulnerability exists in Welcart e‑Commerce up to version 2.11.20 and allows an authenticated user with editor or higher privileges to store malicious JavaScript in the plugin’s settings. When certain pages are rendered, the stored script is executed in the browsers of any user who views those pages, potentially enabling session hijacking, data theft, or defacement. The weakness arises from insufficient sanitization of user input and inadequate output escaping, a classic input validation flaw identified as CWE‑79.

Affected systems are multi‑site WordPress installations running any Welcart e‑Commerce version 2.11.20 or earlier where the unfiltered_html feature has been disabled. Only administrators or editors with write access to the plugin’s settings can exploit the flaw.

The CVSS score of 5.5 denotes a medium severity vulnerability. The EPSS score of less than 1% indicates a low probability of exploitation in the wild today. Since the vulnerability requires authenticated access and the affected environment must have unfiltered_html turned off, the attack surface is narrower, though the impact on users who view the compromised pages is still significant. The vulnerability is not currently listed in CISA’s KEV catalog.