Unscored severity · published Oct 28, 2026
CVE-2026-111031
Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter
New
–
CVSS
–
EPSS
No
On KEV
Description
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Welcart e-Commerce ·
before 2.12.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111031
exploit
https://wpscan.com/vulnerability/7cb3af79-5295-4458-843b-b38e1c3fde25/
More from Welcart e-Commerce
6.5
CVE-2026-16065
Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
5.4
CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
5.4
CVE-2026-16066
Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
5.3
CVE-2026-15213
Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback
–
CVE-2026-111032
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax