The vulnerability is an improper neutralization of script‑related HTML tags in the Welcart e‑Commerce plugin for WordPress, allowing attackers to inject arbitrary JavaScript into pages displayed to site visitors. This is a Basic XSS flaw (CWE‑80) that can compromise user accounts, theft of session cookies, or defacement of the site if the attacker succeeds in executing their scripts. The flaw arises whenever untrusted input is stored and later rendered without proper escaping.

All releases of the Welcart e‑Commerce plugin up to and including version 2.12.6 are affected. Any WordPress site that has not upgraded to 2.12.7 or newer may expose product pages, checkout forms, or other editable fields to this injection risk.

The CVSS score of 6.5 indicates a moderate severity assessment. There is no EPSS data available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack path involves an attacker injecting script tags into product descriptions, comments, or other editable fields, which are then rendered to unsuspecting visitors. While no authentication requirement is stated, the attack remains feasible from unauthenticated or low‑privilege users if the plugin accepts such input.