HomeWordPress vulnerabilitiesWelcart e-Commerce
Welcart e-Commerce vulnerabilities
Welcart e-Commerce has 31 known vulnerabilities in this database. The most recent published record is dated 3 Oct 2026.
- Known vulnerabilities
- 31
- Active installs
- 10,000+
- Latest version
- 2.12.4
- Last updated
- 17 Sep 2026
- Most recent
- 3 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site scripting (XSS) CVE-2026-87091 | High 7.2 | Up to 2.12.2 | Fixed in a later version (latest 2.12.4) | 4 d ago |
| Remote code execution CVE-2026-19887 | High 8.8 | Up to 2.12.1 | Fixed in a later version (latest 2.12.4) | 5 Sep 2026 |
| Cross-site scripting (XSS) CVE-2026-19914 | High 7.2 | Up to 2.12.1 | Fixed in a later version (latest 2.12.4) | 1 Sep 2026 |
| Authentication bypass CVE-2025-15671 | Medium 5.4 | Before 2.12.1 | Fixed in 2.12.1 | 21 Aug 2026 |
| Security weakness CVE-2026-15213 | Medium 5.3 | Before 2.11.33 | Fixed in 2.11.33 | 12 Aug 2026 |
| Cross-site scripting (XSS) CVE-2026-16066 | Medium 5.4 | Before 2.11.34 | Fixed in 2.11.34 | 12 Aug 2026 |
| SQL injection CVE-2026-16065 | Medium 6.5 | Before 2.11.32 | Fixed in 2.11.32 | 6 Aug 2026 |
| Broken access control CVE-2025-12979 | Medium 5.3 | Up to 2.11.24 | Fixed in a later version (latest 2.12.4) | 13 Nov 2025 |
| Cross-site scripting (XSS) CVE-2025-10651 | Medium 5.5 | Up to 2.11.22 | Fixed in a later version (latest 2.12.4) | 22 Oct 2025 |
| SQL injection CVE-2025-10649 | Medium 6.5 | Up to 2.11.21 | Fixed in a later version (latest 2.12.4) | 8 Oct 2025 |
| Cross-site scripting (XSS) CVE-2025-9367 | Medium 5.5 | Up to 2.11.20 | Fixed in a later version (latest 2.12.4) | 10 Sep 2025 |
| PHP object injection Also reported by JVN Japan CVE-2025-27130 | Medium 6.3 | Not yet published | Check for an update | 1 Apr 2025 |
| Cross-site scripting (XSS) CVE-2025-0511 | High 7.2 | Before 2.11.10 | Fixed in 2.11.10 | 12 Feb 2025 |
| Cross-site scripting (XSS) Also reported by JVN Japan CVE-2024-42404 | High 8.8 | Not yet published | Check for an update | 18 Sep 2024 |
| Cross-site scripting (XSS) Also reported by JVN Japan CVE-2024-45366 | High 8.8 | Not yet published | Check for an update | 18 Sep 2024 |
| Path traversal CVE-2023-6120 | Medium 4.1 | Before 2.9.7 | Fixed in 2.9.7 | 9 Dec 2023 |
| Cross-site scripting (XSS) CVE-2023-5951 | Medium 6.1 | Before 2.9.5 | Fixed in 2.9.5 | 4 Dec 2023 |
| PHP object injection CVE-2023-5952 | Critical 9.8 | Before 2.9.5 | Fixed in 2.9.5 | 4 Dec 2023 |
| Cross-site request forgery (CSRF) CVE-2023-5953 | High 8.8 | Before 2.9.5 | Fixed in 2.9.5 | 4 Dec 2023 |
| Broken access control CVE-2021-4375 | Medium 4.3 | Up to 2.2.7 | Fixed in a later version (latest 2.12.4) | 7 Jun 2023 |
| Broken access control CVE-2021-4355 | High 7.5 | Up to 2.2.7 | Fixed in a later version (latest 2.12.4) | 7 Jun 2023 |
| Cross-site scripting (XSS) CVE-2022-4655 | Medium 5.4 | Before 2.8.9 | Fixed in 2.8.9 | 16 Jan 2023 |
| Security weakness CVE-2022-4140 | High 7.5 | Before 2.8.5 | Fixed in 2.8.5 | 2 Jan 2023 |
| Security weakness CVE-2022-4236 | Medium 6.5 | Before 2.8.5 | Fixed in 2.8.5 | 2 Jan 2023 |
| Security weakness CVE-2022-4237 | High 8.8 | Before 2.8.6 | Fixed in 2.8.6 | 2 Jan 2023 |
| Cross-site scripting (XSS) CVE-2022-3935 | Medium 5.4 | Before 2.8.4 | Fixed in 2.8.4 | 12 Dec 2022 |
| Cross-site request forgery (CSRF) CVE-2022-3946 | Medium 6.5 | Before 2.8.4 | Fixed in 2.8.4 | 12 Dec 2022 |
| Path traversal CVE-2022-41840 | High 7.5 | Before 2.7.8 | Fixed in 2.7.8 | 18 Nov 2022 |
| PHP object injection CVE-2020-28339 | High 7.5 | Before 1.9.36 | Fixed in 1.9.36 | 7 Nov 2020 |
| SQL injection CVE-2014-10017 | Not scored | Not yet published | Check for an update | 13 Jan 2015 |
| Cross-site scripting (XSS) CVE-2014-10016 | Not scored | Not yet published | Check for an update | 13 Jan 2015 |
Read the published descriptions
- CVE-2026-87091, 3 Oct 2026
- The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endpoint accepts the 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification, meaning any unauthenticated attacker can directly submit malicious payloads that are stored and later rendered in the administrator's settlement error log view. CVE record
- CVE-2026-19887, 5 Sep 2026
- The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion. CVE record
- CVE-2026-19914, 1 Sep 2026
- The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is delivered via the guest checkout form, requiring no authentication, and executes when an administrator views the affected order in the WordPress admin panel. CVE record
- CVE-2025-15671, 21 Aug 2026
- The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request. CVE record
- CVE-2026-15213, 12 Aug 2026
- The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying. CVE record
- CVE-2026-16066, 12 Aug 2026
- The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page. CVE record
- CVE-2026-16065, 6 Aug 2026
- The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks. CVE record
- CVE-2025-12979, 13 Nov 2025
- The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials (ex. PayPal api secret) , as well as business contact details, mail templates, and other operational settings tied to the store. CVE record
- CVE-2025-10651, 22 Oct 2025
- The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22. This is due to insufficient sanitization on the order_mail field and a lack of escaping on output. This makes it possible for authenticated attackers, with Editor-level permissions and above, to inject arbitrary web scripts via the General Setting page that will execute when an administrator accesses the E-mail Setting page. CVE record
- CVE-2025-10649, 8 Oct 2025
- The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2025-9367, 10 Sep 2025
- The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE record
- CVE-2025-27130, 1 Apr 2025
- WordPress plugin "Welcart e-Commerce" provided by Welcart Inc. contains an untrusted data deserialization vulnerability (CWE-502). Hiroshi Sawada of CrowdStrike Holdings, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE record
- CVE-2025-0511, 12 Feb 2025
- The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-42404, 18 Sep 2024
- WordPress plugin "Welcart e-Commerce" provided by Welcart Inc. contains multiple vulnerabilities listed below. SQL injection (CWE-89) - CVE-2024-42404 Cross-site scripting (CWE-79) - CVE-2024-45366 Shogo Kumamaru of LAC CyberLink Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE record
- CVE-2024-45366, 18 Sep 2024
- WordPress plugin "Welcart e-Commerce" provided by Welcart Inc. contains multiple vulnerabilities listed below. SQL injection (CWE-89) - CVE-2024-42404 Cross-site scripting (CWE-79) - CVE-2024-45366 Shogo Kumamaru of LAC CyberLink Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE record
- CVE-2023-6120, 9 Dec 2023
- The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server. CVE record
- CVE-2023-5951, 4 Dec 2023
- The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin CVE record
- CVE-2023-5952, 4 Dec 2023
- The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog CVE record
- CVE-2023-5953, 4 Dec 2023
- The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server CVE record
- CVE-2021-4375, 7 Jun 2023
- The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information() function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPress settings, plugin settings, PHP settings and server settings. CVE record
- CVE-2021-4355, 7 Jun 2023
- The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders. CVE record
- CVE-2022-4655, 16 Jan 2023
- The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack. CVE record
- CVE-2022-4140, 2 Jan 2023
- The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server CVE record
- CVE-2022-4236, 2 Jan 2023
- The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server. CVE record
- CVE-2022-4237, 2 Jan 2023
- The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog CVE record
- CVE-2022-3935, 12 Dec 2022
- The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks CVE record
- CVE-2022-3946, 12 Dec 2022
- The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods. CVE record
- CVE-2022-41840, 18 Nov 2022
- Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. CVE record
- CVE-2020-28339, 7 Nov 2020
- The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain. CVE record
- CVE-2014-10017, 13 Jan 2015
- Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) changeSort or (2) switch parameter in the usces_itemedit page to wp-admin/admin.php. CVE record
- CVE-2014-10016, 13 Jan 2015
- Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchase_limit or the (2) name, (3) intl, (4) nocod, or (5) time parameter in an add_delivery_method action to wp-admin/admin-ajax.php. CVE record
What to do if you run Welcart e-Commerce
If you run Welcart e-Commerce, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Welcart e-Commerce vulnerabilities
Free. We email you when a new vulnerability is published for Welcart e-Commerce, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.