The Welcart e-Commerce plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the 'order_mail' setting. Authenticated users with Editor-level permissions or above can inject arbitrary web scripts via the General Setting page. These scripts execute in the context of administrators accessing the E-mail Setting page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions up to and including 2.11.22. No patch or remediation details are currently available.

Successful exploitation allows an authenticated user with Editor or higher privileges to inject and execute arbitrary JavaScript in the context of an administrator's browser. This can lead to unauthorized actions performed with administrator privileges, such as session hijacking or manipulation of administrative functions. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score of 5.5 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor-level permissions carefully and avoid granting them to untrusted users. Administrators should be cautious when accessing the E-mail Setting page if untrusted users have Editor or higher permissions. Monitor vendor channels for updates regarding patches or official mitigations.