Welcart e-Commerce Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Welcart e-Commerce plugin for WordPress, affecting versions through 2.11.22. The issue arises from inadequate sanitization of the 'order_mail' setting and a failure to properly escape output. This vulnerability allows authenticated attackers with Editor-level permissions or higher to inject arbitrary scripts via the General Settings page, which are executed when an administrator accesses the E-mail Settings page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the E-mail Settings page.

Remediation

Users can update to Welcart e-Commerce version 2.11.23 or later to address this vulnerability.