CVE-2021-20734: 
WordPress vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability was discovered in Welcart e-Commerce versions prior to 2.2.4. The vulnerability was discovered by Yu Iwama of Secure Sky Technology Inc and was publicly disclosed on June 11, 2021. The affected software is a WordPress plugin provided by Collne Inc (JVN Report).

The vulnerability exists due to improper sanitization of the order_id parameter in the admin dashboard. This allows for a reflected cross-site scripting attack. The vulnerability has been assigned a CVSS v3.0 base score of 6.1 (medium severity), with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. A proof of concept exists showing that the vulnerability can be exploited via the admin dashboard URL path: wp-admin/admin.php?page=usces_orderlist&order_action=edit&order_id (WPScan).

If successfully exploited, this vulnerability allows attackers to inject and execute arbitrary JavaScript code in the context of an administrative user's browser session. When an administrator views a malicious page while logged into the affected system, arbitrary scripts may be executed with their privileges (JVN Report).

The vulnerability requires user interaction and can be exploited when an administrator views a specially crafted malicious page. The attack complexity is considered low, requiring no privileges for exploitation, though user interaction is necessary (JVN Report).

The vulnerability has been patched in Welcart e-Commerce version 2.2.4. Users are strongly advised to update to this version or later to address the security issue. The fix was released by the developer Collne Inc to address the vulnerability (Welcart).