CVE-2026-27539

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce versions up to 2.11.31. An attacker can inject malicious script without authentication.

Risk Assessment

Risk of session hijacking, admin account takeover, or malware distribution on the site.

Recommendation

Update the Welcart e-Commerce plugin to the latest version that includes the security fix.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.