Input validation vulnerability in Welcart e-Commerce 2.9.4

The Welcart e-Commerce plugin for WordPress is vulnerable to a type of security attack called Reflected Cross-Site Scripting. This vulnerability affects all versions of the plugin from 2.9.4 and earlier. It is possible for unauthenticated attackers to inject malicious web scripts on pages that can be executed if a user is tricked into performing an action, such as clicking on a link. This happens because the plugin does not properly sanitize user input or properly escape output.