CVE-2026-96761: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Welcart Welcart e-Commerce

The vulnerability identified as CVE-2026-96761 affects Welcart e-Commerce through version 2.12.3. It is a reflected cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that execute in the context of a user's browser session, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Attackers may execute arbitrary scripts in the context of the victim's browser, potentially stealing sensitive information or performing unauthorized actions. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider temporary mitigations such as input validation or output encoding where feasible.