Aggregates CVE and security vulnerability intelligence across all welcart-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk sql injection, vendor risk path handling, and vendor risk csrf and related problems; some flaws may lead to vendor impact data exposure and vendor impact file overwrite.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-47511 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13. | [email protected] | 6.8 | 0.34% | 2025-06-09 | 2026-04-23 |
| CVE-2025-27130 | Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product. | [email protected] | 8.8 | 0.61% | 2025-04-01 | 2025-07-08 |
| CVE-2025-0511 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | [email protected] | 7.2 | 0.90% | 2025-02-12 | 2025-02-20 |
| CVE-2024-45366 | Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser. | [email protected] | 6.1 | 0.26% | 2024-09-18 | 2025-07-10 |
| CVE-2024-42404 | SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database. | [email protected] | 8.8 | 0.59% | 2024-09-18 | 2025-07-10 |
| CVE-2024-32144 | Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14. | [email protected] | 5.4 | 0.09% | 2024-06-11 | 2024-11-21 |
| CVE-2023-50847 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3. | [email protected] | 7.6 | 0.29% | 2023-12-28 | 2026-04-28 |
| CVE-2023-6120 | The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server. | [email protected] | 4.1 | 0.12% | 2023-12-09 | 2026-04-08 |
| CVE-2023-5953 | The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server | [email protected] | 8.8 | 0.23% | 2023-12-04 | 2025-05-29 |
| CVE-2023-5952 | The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog | [email protected] | 9.8 | 0.69% | 2023-12-04 | 2025-02-20 |
| CVE-2023-5951 | The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | [email protected] | 6.1 | 0.28% | 2023-12-04 | 2025-02-20 |
| CVE-2023-43614 | Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script. | [email protected] | 6.1 | 0.24% | 2023-09-27 | 2025-02-20 |
| CVE-2023-43610 | SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations. | [email protected] | 8.8 | 0.43% | 2023-09-27 | 2025-02-20 |
| CVE-2023-43493 | SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information. | [email protected] | 4.9 | 0.42% | 2023-09-27 | 2025-02-20 |
| CVE-2023-43484 | Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script. | [email protected] | 6.1 | 0.23% | 2023-09-27 | 2025-02-20 |
| CVE-2023-41962 | Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page. | [email protected] | 6.1 | 0.29% | 2023-09-27 | 2025-02-20 |
| CVE-2023-41233 | Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script. | [email protected] | 6.1 | 0.24% | 2023-09-27 | 2025-02-20 |
| CVE-2023-40219 | Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory. | [email protected] | 7.2 | 0.46% | 2023-09-27 | 2025-02-20 |
| CVE-2021-4375 | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information() function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPress settings, plugin settings, PHP settings and server settings. | [email protected] | 4.3 | 0.07% | 2023-06-07 | 2026-04-08 |
| CVE-2021-4355 | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders. | [email protected] | 7.5 | 0.94% | 2023-06-07 | 2026-04-08 |