The vulnerability is a stored cross‑site scripting flaw caused by inadequate neutralization of user input before rendering it on web pages. An attacker could supply malicious scripts that are later executed in the browser of anyone who views the affected page, potentially enabling cookie theft, session hijacking, or phishing attempts.

The vulnerable component is the Welcart e‑Commerce WordPress plugin, versions up through 2.12.6. Updating to 2.12.7 or later removes the flaw.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. No EPSS data is available and the vulnerability is not listed in KEV. Exploitation would most likely be carried out by inserting malicious input through the plugin’s interface, which is then stored and displayed to other users. While no public exploit has been reported, the stored XSS nature means that any user who accesses the vulnerable content could be compromised.