The Welcart e-Commerce plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with editor or higher privileges can inject arbitrary JavaScript into plugin settings, which is then stored and executed in the context of users visiting affected pages. This issue affects multi-site installations or those with unfiltered_html disabled, present in all versions up to 2.11.20. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium impact with network attack vector, low attack complexity, and high privileges required. There is no indication of known exploits in the wild or an available patch at this time.

Successful exploitation allows authenticated users with editor-level or higher permissions to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability and requires high privileges, limiting the attack surface. It specifically impacts multi-site WordPress installations or those with unfiltered_html disabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict editor-level permissions to trusted users only and consider disabling multi-site installations or enabling unfiltered_html if feasible. Monitor official Welcart and WordPress security channels for updates and apply patches promptly once available.