CVE-2026-87091 Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-91910

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-87091 Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-87091

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.12.2 . The root cause is insufficient input sanitization and output escaping regarding the 'rel' and 'option' parameters within the IPN endpoint. Because these para...

CVE-2026-87091: Improper Neutralization of Input During Web Page Generation

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-104506

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scrip...

CVE-2026-11795

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: before 5.03.01.54...

EUVD-2026-91591

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-11795

The Softtr Informatics Trading Limited Company E-Commerce Pack (affected through 2026-10-02) contains an observable discrepancy vulnerability (CWE-203) that facilitates Account Footprinting . This flaw allows for user enumeration or footprinting within the application. No specific root cause deta...

CVE-2026-11795 User Enumeration in Softtr's E-Commerce Pack

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: before 5.03.01.54...

CVE-2026-11795: Observable Discrepancy

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-104320

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2025-61456

🛡️ Раскрытие CVE: CVE-2025-61456 — Отражённый XSS в проекте интернет-магазина Дата раскрытия: 14 октября 2025 г. ID CVE: CVE-2025-61456 Серьёзность: СРЕДНЯЯ CVSS 6.1 🧩 Краткое описание Уязвимость отражённого межсайтового скриптинга XSS существует в E-commerce Project v1.0, а именно в конечной точк...

CVE-2025-61455

🛡️ Раскрытие CVE: CVE-2025-61455 — SQL-инъекция в проекте электронной коммерции Дата раскрытия: 14 октября 2025 г. Идентификатор CVE: CVE-2025-61455 Серьёзность: КРИТИЧЕСКАЯ CVSS 9.8 🧩 Краткое описание Критическая уязвимость SQL-инъекции существует в E-commerce Project v1.0, а именно в конечной...

CVE-2025-61454

🛡️ Раскрытие CVE: CVE-2025-61454 — Отражённый XSS в E-commerce Project Дата раскрытия: 14 октября 2025 г. Идентификатор CVE: CVE-2025-61454 Серьёзность: СРЕДНЯЯ CVSS 6.1 🧩 Краткое описание Уязвимость отражённого межсайтового скриптинга XSS существует в E-commerce Project v1.0, а именно в конечной...

CVE-2026-92994

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994

The Verge3D Publishing and E-Commerce WordPress plugin before version 4.13.1 is vulnerable to unauthenticated Stored XSS . The flaw exists because the plugin's file storage feature fails to validate the contents of uploaded files and serves them back with an attacker-controlled content type. This...

EUVD-2026-89622

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...