CVE-2026-19914: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in uscnanbu Welcart e-Commerce

CVE-2026-19914 describes a stored cross-site scripting vulnerability in the Welcart e-Commerce WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'custom_order' parameter. Attackers can exploit this by submitting malicious payloads through the guest checkout form, which requires no authentication. The payload executes in the context of the WordPress admin panel when an administrator views the compromised order, potentially leading to session hijacking or other script-based attacks.

An unauthenticated attacker can inject arbitrary web scripts that execute in the administrator's browser context when viewing an order. This can lead to information disclosure, session hijacking, or other impacts related to cross-site scripting. The vulnerability does not affect availability but compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the available data. Until a patch is available, restrict access to the WordPress admin panel and monitor for suspicious activity related to order entries.