Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-16066 The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the … https://www.cve.org/CVERecord?id=CVE-2026-16066
Post summary
The CVE discloses an unsanitized product field in Welcart e‑Commerce WordPress plugin, mitigated in version 2.11.34.
🚨*CVE* CVE-2026-16066 The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the … https://www.cve.org/CVERecord?id=CVE-2026-16066 ----- Traducción: CVE-2026-16066 El … http://infoflow.cloud`
Post summary
The tweet briefly references CVE-2026-16066, highlighting a missing sanitization in the Welcart WordPress plugin prior to version 2.11.34, but provides no PoC, exploit code, patch, or evidence of active exploitation.