CVE-2026-7298

CVE-2026-7298 is a Reflected XSS vulnerability in IdeaSoft Smart E-Commerce (through version 11092026), caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.1 (Medium) with a network attack vector, low complexity, no required privileges, but user interact...

EUVD-2026-76163

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure bu...

CVE-2025-61454

🛡️ Divulgación de CVE: CVE-2025-61454 — XSS Reflejado en Proyecto de Comercio Electrónico Fecha de divulgación: 14 de octubre de 2025 ID de CVE: CVE-2025-61454 Severidad: MEDIA CVSS 6.1 🧩 Resumen Existe una vulnerabilidad de Cross-Site Scripting XSS reflejado en el Proyecto de Comercio Electrónico...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...

EUVD-2026-71883

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability

Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability discovered by daroo in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

CVE-2026-19914

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-19914

Welcart e-Commerce (WordPress plugin) has a Stored Cross-Site Scripting vulnerability via the custom_order parameter , affecting all versions up to and including 2.12.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject arbitrary scripts...

EUVD-2026-68997

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-19914 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'customorder' Parameter vulnerability discovered by Afifudin Maarif in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

CVE-2026-5800

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows Reflected XSS. This issue affects E-Commerce Platform: through 28082026. NOTE: The vendor was contacted early about this disclosu...

CVE-2026-4378

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001...

CVE-2026-4378

A Stored Cross-Site Scripting (XSS) vulnerability in Akilli Ticaret Software Technologies Ltd. 's E-Commerce Pack (versions 4.5.001 through 28082026) is caused by improper neutralization of input during web page generation . The CVSS 3.1 score is 5.4 (MEDIUM) with a changed scope, indicating a lo...

EUVD-2026-67740

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this...

CVE-2026-4378 Stored XSS in Akıllı Ticaret's E-Commerce Pack

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001...

CVE-2026-5800 Reflected XSS in Dayneks Software's E-Commerce Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows Reflected XSS. This issue affects E-Commerce Platform: through 28082026. NOTE: The vendor was contacted early about this disclosu...

CVE-2026-5800

CVE-2026-5800 is a Reflected XSS vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform , caused by improper neutralization of input during web page generation. It affects versions through 28082026 . The CVSS 3.1 score is 6.1 (MEDIUM) with a changed scope, requiring user in...