Understanding and Defending Against CVE-2026-118070: Stored Cross-Site Scripting in Welcart e-Commerce Plugin
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'gid' parameter in versions up to 2.12.5. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, which execute when a user accesses an injected page. The attack involves forging a ROBOT PAYMENT browser-return request to store a malicious 'gid' value in order metadata, which then triggers the script when an administrator views the order.