Welcart e‑Commerce allows malicious input to be reflected in a browser response without proper HTML escaping. An attacker can inject arbitrary JavaScript that runs in the context of visitors who view the affected page, potentially compromising their session or executing unauthorized commands. This reflected XSS flaw is defined as CWE‑79 and can be used to steal credentials or deface the site.

WordPress sites running the Welcart e‑Commerce plugin version 2.12.3 or older are affected. The vulnerability is present in all releases from the earliest available version up through 2.12.3.

The CVSS score of 7.1 indicates a high severity impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is through crafted URLs or form inputs that the plugin does not sanitize, allowing an attacker to supply malicious payloads that will be reflected back to the user who clicks the link or submits the form.