Input validation vulnerability in Welcart e-Commerce 2.11.22

The Welcart e-Commerce plugin, which is used with WordPress, has a security issue where attackers can insert harmful code through a specific setting called ‘order_mail’. This can happen because the plugin does not properly check for malicious code and does not protect the output of the code. This means that someone with certain permissions can inject harmful code that will run when an administrator uses the E-mail Setting page.