Medium severity · published Aug 12, 2026
CVE-2026-16066
Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Welcart e-Commerce ·
before 2.11.34 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16066
wpscan.com
https://wpscan.com/vulnerability/ed3b39a6-493c-490e-af41-c4d04992e19e/
More from Welcart e-Commerce
6.5
CVE-2026-16065
Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
5.4
CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
5.3
CVE-2026-15213
Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback
–
CVE-2026-111032
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
–
CVE-2026-111031
Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter