What’s Vulnerable › Vulnerabilities

CVE-2025-10651: Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-22 · updated 2026-10-08
• Weakness: CWE-79

Description

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22. This is due to insufficient sanitization on the order_mail field and a lack of escaping on output. This makes it possible for authenticated attackers, with Editor-level permissions and above, to inject arbitrary web scripts via the General Setting page that will execute when an administrator accesses the E-mail Setting page.

Affected products

• Welcart e-Commerce: through 2.11.22

References

• https://plugins.trac.wordpress.org/changeset/3374769/usc-e-shop
• https://www.welcart.com/archives/26052.html
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1f81e8-64ed-4330-9c76-1a8d2e2d307d?source=cve

Get alerted when CVE-2025-10651 or the next vulnerability affects your stack