What’s Vulnerable › Products
Welcart e-Commerce vulnerabilities
57 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.
Check whether your Welcart e-Commerce version is affected
Latest Welcart e-Commerce vulnerabilities
- CVE-2026-119166 — Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter (CVSS 5.3)
- CVE-2026-118070 — Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter (CVSS 7.2)
- CVE-2026-107752 — Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie (CVSS 4.9)
- CVE-2026-96761 — WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-87091 — Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters (CVSS 7.2)
- CVE-2026-19887 — Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback (CVSS 8.8)
- CVE-2026-19914 — Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter (CVSS 7.2)
- CVE-2025-15671 — Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter (CVSS 5.4)
- CVE-2026-27539 — WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-15213 — Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback (CVSS 5.3)
- CVE-2026-16066 — Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name (CVSS 5.4)
- CVE-2026-16065 — Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import (CVSS 6.5)
- CVE-2026-49775 — WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2025-12979 — Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3)
- CVE-2025-62953 — WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2025-10651 — Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail (CVSS 5.5)
- CVE-2025-10649 — Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie (CVSS 6.5)
- CVE-2025-9367 — Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 5.5)
- CVE-2025-58984 — WordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- CVE-2025-54012 — WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability (CVSS 7.2)
- CVE-2025-54013 — WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- CVE-2025-47511 — WordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability (CVSS 6.5)
- CVE-2025-27130 — (CVSS 8.8)
- CVE-2025-0511 — Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter (CVSS 6.1)
- CVE-2024-45366 — (CVSS 6.1)