CVE-2026-87091

Executive Summary

CVE-2026-87091 is a stored cross-site scripting (XSS) vulnerability in the Welcart e-Commerce plugin for WordPress, affecting all versions up to and including 2.12.2. The flaw resides in the plugin's Instant Payment Notification (IPN) / Settlement Notification endpoint, which accepts the rel and option parameters without authentication, nonce validation, or signature verification. Because the parameters are insufficiently sanitized on input and insufficiently escaped on output, an unauthenticated attacker can store arbitrary JavaScript that executes in the administrator's browser when the settlement error log view is opened, with a CVSS base score of 7.2.

Technical Analysis

The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting), specifically the stored (persistent) variant. According to the NVD description, the injection point is the plugin's IPN / Settlement Notification handling logic, which parses incoming notification parameters named rel and option. Three control failures combine to produce the vulnerability:

1. Absent authentication and integrity controls — the IPN endpoint accepts these parameters "with no authentication, nonce validation, or signature verification." This means the endpoint is reachable by an unauthenticated remote user, and there is no mechanism to confirm that a submitted notification genuinely originated from a payment processor. The lack of nonce validation and signature verification removes the two controls that WordPress plugins normally use to bind a request to a legitimate sender and a valid session.
2. Insufficient input sanitization — attacker-supplied values in rel and option are not sanitized before being persisted. As a result, malicious markup and script content survives storage.
3. Insufficient output escaping — when the stored values are later rendered, the output is not escaped, so the injected script is emitted as executable markup rather than inert text.

The specific rendering sink described in the NVD data is the administrator's settlement error log view. Any administrator who loads that view causes the stored payload to execute in the context of the WordPress administrative origin. This is consistent with the CVSS 3.1 scope change (S:C) in the vector: the vulnerable component, the Welcart plugin, can affect resources beyond its own security scope — the administrative session and the broader WordPress installation.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates: network-exploitable, low attack complexity, no privileges required, no user interaction required, changed scope, and low confidentiality and integrity impact with no availability impact. The low CIA impact ratings reflect that XSS typically yields script execution in a browser context rather than direct server compromise, while the scope change reflects the privilege boundary crossing from an unauthenticated visitor to the administrator's browser session.

No public proof-of-concept, Nuclei template, or exploit code was identified in the provided data. The attack chain below is therefore described at the vulnerability-class level and is inferred from the NVD description, not from a published exploit.

Notably, the vendor/product fields in the supplied intelligence record are marked "Unknown," while the description explicitly names the Welcart e-Commerce plugin for WordPress. The authoritative attribution here is the plugin, and affected installations are those running Welcart at version 2.12.2 or earlier.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the parameter and sink names explicitly stated in the NVD description.

1. Reconnaissance / target identification. An attacker enumerates WordPress sites and fingerprints installations of the Welcart e-Commerce plugin, for example by requesting known plugin asset paths under the WordPress wp-content/plugins/ directory or by identifying Welcart-specific page markup. Because the IPN endpoint accepts unauthenticated requests, no credential-gathering phase is required. The attacker locates the settlement notification endpoint exposed by the plugin.

2. Triggering the flaw class (unauthenticated stored XSS injection). The attacker submits an HTTP request directly to the IPN / settlement notification endpoint, supplying malicious content in the rel and/or option parameters. No session cookie, nonce, or cryptographic signature is required or checked. Because the endpoint performs no signature verification, the plugin cannot distinguish the request from a legitimate payment-processor callback.

3. Payload storage and persistence. The unsanitized parameter values are stored by the plugin. From this point the payload is persistent — it survives across requests and does not depend on the attacker's session.

4. Execution in the administrator context. When a site administrator later accesses the settlement error log view, the stored values are rendered without output escaping, and the injected script executes in the administrator's browser under the WordPress administrative origin.

5. Post-exploitation impact. Code executing in an authenticated administrator's browser can perform any action the administrator is authorized to perform in the WordPress dashboard, including creating or modifying content and users, altering plugin and theme settings, and exfiltrating data visible to the admin session. The CVSS scope change (S:C) reflects that the impact extends beyond the plugin to the wider WordPress administrative context. The rated impacts are limited to low confidentiality and integrity, with no availability impact, consistent with a script-execution flaw rather than direct server-side compromise.

Impact Assessment

Affected systems. All WordPress installations running the Welcart e-Commerce plugin at version 2.12.2 or earlier. Because the injection endpoint requires no authentication, any internet-exposed Welcart store is a potential target; the victim of execution is specifically an authenticated administrator who views the settlement error log.

Business impact.

• Integrity (Low per CVSS, but operationally significant): injected scripts execute with the privileges of the viewing administrator, enabling unauthorized modification of store configuration, content, or user accounts within the limits of that administrator's role.
• Confidentiality (Low): data visible to the admin session — including administrative interfaces and stored order/settlement information rendered in that view — may be read and exfiltrated.
• Availability (None): the vector indicates no direct availability impact.
• Scope (Changed): the flaw crosses a trust boundary from unauthenticated external input to the authenticated WordPress administrative context.

Blast radius. Any Welcart deployment at or below 2.12.2 is in scope. The attack does not require a phishing step or any pre-existing foothold; the only prerequisite for execution is that an administrator opens the affected settlement error log view. E-commerce stores are high-value targets because administrator-level access can expose customer and order data and enable persistent storefront manipulation.

Exploitability. CVSS rates attack complexity Low, privileges required None, and user interaction None, yielding a base score of 7.2 (High severity). The practical constraint on exploitation is the requirement that an administrator view the injected log page.

Detection Guidance

Sigma Rule

title: Welcart Settlement Notification Stored XSS Injection Attempt
id: 8f3c1a72-4b91-4e0d-9a55-7c2e6d1f0b34
status: experimental
description: Detects unauthenticated HTTP requests to the Welcart IPN/settlement notification endpoint carrying suspicious markup in the rel or option parameters, consistent with CVE-2026-87091 stored XSS.
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'welcart'
      - 'settlement'
      - 'ipn'
  selection_params:
    cs-uri-query|contains:
      - 'rel='
      - 'option='
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<img'
      - '<svg'
  condition: selection_endpoint and selection_params and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate payment processor callbacks containing encoded HTML entities
level: high

YARA Rule

rule CVE_2026_87091_Welcart_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Welcart settlement notification parameters (CVE-2026-87091)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87091"
        severity = "high"

    strings:
        $rel = "rel=" ascii nocase
        $opt = "option=" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "<svg" ascii nocase
        $s6 = "<img" ascii nocase

    condition:
        (any of ($rel, $opt)) and (any of ($s1, $s2, $s3, $s4, $s5, $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87091 Welcart Settlement Notification Stored XSS Injection Attempt"; flow:established,to_server; http.uri; content:"welcart"; nocase; http.uri; content:"rel="; nocase; http.uri; content:"option="; nocase; http.uri; pcre:"/(%3C|<)script|javascript:|onerror=|onload=/iU"; classtype:web-application-attack; reference:cve,2026-87091; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87091; sid:202687091; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.protocol == "http"
    and url.query : "*welcart*"
    and url.query : "*rel=*"
    and url.query : "*option=*"
    and url.query : ("*<script*" or "*javascript:*" or "*onerror=*" or "*onload=*" or "*%3Cscript*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(_raw, "(?i)(welcart|settlement|ipn)")
| where match(_raw, "(?i)rel=") AND match(_raw, "(?i)option=")
| where match(_raw, "(?i)(%3Cscript|<script|javascript:|onerror=|onload=|%3Cimg|<img)")
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, uri_query, status
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,welcart,">
  <rule id="2026870" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <id>31100</id>
    <match>welcart</match>
    <regex>rel=.*option=|option=.*rel=</regex>
    <regex>(%3Cscript|<script|javascript:|onerror=|onload=|%3Csvg|<svg)</regex>
    <description>CVE-2026-87091: Welcart settlement notification stored XSS injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD record indicates a patch is claimed, but no patched version string or vendor advisory was available in the supplied data. Treat remediation as unverified until a Welcart vendor advisory is obtained.

1) Immediate mitigations (until a verified patch is applied):

• Restrict or block access to the plugin's IPN / settlement notification endpoint at the web server, WAF, or reverse proxy so only known payment-processor source IPs may reach it. Because the endpoint performs no signature verification, source-IP allowlisting is the most practical interim control.
• Deploy a WAF rule that rejects requests to the endpoint containing HTML/JavaScript metacharacters in the rel and option parameters.
• Do not view the settlement error log in an administrative session until the injected content is known to be absent or has been cleared.
• Audit and sanitize previously stored settlement notification / error log data to remove any already-persisted payloads.
• Monitor web access logs for the detection signatures above to identify prior injection attempts.

2) Patch / upgrade steps:

• A patch is claimed by a single source (NVD) but is not independently confirmed. Verify against the official Welcart vendor release channel before acting.
• When a fixed version is confirmed available, back up the site database and files, then upgrade the Welcart plugin to the fixed release.
• After upgrading, re-audit stored settlement error log data, since an upgrade does not remove payloads injected before patching.
• Validate the fix by re-triggering the detection rules against the endpoint with benign test payloads to confirm the parameters are now rejected or neutralized.

3) Long-term hardening:

• Enforce signature verification and nonce validation on all payment callback / IPN endpoints; unauthenticated callbacks should always be cryptographically verified.
• Apply WordPress sanitization on input and context-aware escaping on output for any user- or callback-supplied data, especially before it is written to logs and later rendered in administrative views.
• Apply least-privilege to administrative roles and avoid browsing untrusted or log-rendering admin pages in a session used for high-privilege tasks.
• Add egress filtering and content security policy (CSP) headers to reduce the impact of any successful XSS.
• Include plugin inventory and version monitoring in patch management so e-commerce plugins are tracked for advisories like this one.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-87091
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') — https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• Welcart e-Commerce plugin (WordPress.org plugin directory — verify current version and changelog for patch confirmation): https://wordpress.org/plugins/welcart-e-commerce/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-87091 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. No public PoC, Nuclei template, or exploit code was available at the time of writing. EPSS has not yet scored this CVE; no EPSS value is asserted here.