https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T16:59:38.347702+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-16066 CVE-2026-16066 — Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name 2026-10-08T16:59:38.362804+00:00

Affected: Unknown Welcart e-Commerce

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.