The Welcart e-Commerce WordPress plugin versions prior to 2.11.34 do not properly sanitize or escape product fields before outputting them on product pages. This allows users with Author role or above to inject arbitrary JavaScript code, resulting in a stored cross-site scripting (XSS) vulnerability. The injected scripts execute in the context of any visitor viewing the product page, potentially leading to session hijacking, defacement, or other client-side attacks. No CVSS score or vendor advisory is provided, and no patch information is currently available.

Users with Author role or higher can inject malicious scripts into product fields that execute in the browsers of visitors to the product pages. This can lead to theft of session cookies, redirection to malicious sites, or other client-side attacks against visitors. The vulnerability affects the confidentiality and integrity of user sessions and site content as rendered in browsers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author role privileges to trusted users only and consider disabling product editing by non-administrators. Monitor official Welcart channels for updates and apply patches promptly once released.