Plugin icon

Welcart e-Commerce

usc-e-shop

Vulnerabilities:

45

Last Updated:

January 21, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2025-11-12
Title
Welcart e-Commerce < 2.11.25 - Missing Authorization to Unauthenticated Information Exposure
Fixed in
Fixed in 2.11.25
CVSS
5.3 (medium)
Published
2025-10-21
Title
Welcart e-Commerce < 2.11.23 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail
Fixed in
Fixed in 2.11.23
CVSS
5.5 (medium)
Published
2025-10-14
Title
Welcart e-Commerce < 2.11.25 - Missing Authorization
Fixed in
Fixed in 2.11.25
CVSS
4.3 (medium)
Published
2025-10-07
Title
Welcart e-Commerce < 2.11.22 - Authenticated (Author+) SQL Injection via Cookie
Fixed in
Fixed in 2.11.22
CVSS
6.5 (medium)
Published
2025-09-09
Title
Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.11.21
CVSS
5.5 (medium)
Published
2025-09-09
Title
Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.11.21
CVSS
4.4 (medium)
Published
2025-08-12
Title
Welcart e-Commerce < 2.11.17 - Authenticated (Editor+) PHP Object Injection
Fixed in
Fixed in 2.11.17
CVSS
6.6 (medium)
Published
2025-07-16
Title
Welcart e-Commerce < 2.11.17 - Authenticated (Editor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.11.17
CVSS
5.5 (medium)
Published
2025-06-03
Title
Welcart e-Commerce < 2.11.14 - Authenticated (Editor+) Arbitrary File Deletion
Fixed in
Fixed in 2.11.14
CVSS
6.5 (medium)
Published
2025-02-11
Title
Welcart e-Commerce < 2.11.10 - Unauthenticated Stored Cross-Site Scripting via name Parameter
Fixed in
Fixed in 2.11.10
CVSS
7.2 (high)
Published
2024-09-18
Title
Welcart e-Commerce < 2.11.2 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 2.11.2
CVSS
4.9 (medium)
Published
2024-04-12
Title
Welcart e-Commerce < 2.10.0 - Missing Authorization
Fixed in
Fixed in 2.10.0
CVSS
5.4 (medium)
Published
2023-12-21
Title
Welcart e-Commerce < 2.9.4 - Authenticated(Editor+) SQL Injection
Fixed in
Fixed in 2.9.4
CVSS
7.2 (high)
Published
2023-12-08
Title
Welcart e-Commerce < 2.9.7 - Authenticated (Administrator+) Directory Traversal
Fixed in
Fixed in 2.9.7
CVSS
4.1 (medium)
Published
2023-11-15
Title
Welcart e-Commerce < 2.9.6 - Admin+ PHP Object Injection
Fixed in
Fixed in 2.9.6
CVSS
7.2 (high)
Published
2023-11-14
Title
Welcart e-Commerce < 2.9.5 - Cross-Site Request Forgery
Fixed in
Fixed in 2.9.5
CVSS
8.8 (high)
Published
2023-11-10
Title
Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 2.9.5
CVSS
8.1 (high)
Published
2023-11-10
Title
Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload
Fixed in
Fixed in 2.9.5
CVSS
8.5 (high)
Published
2023-11-10
Title
Welcart e-Commerce < 2.9.5 - Reflected XSS
Fixed in
Fixed in 2.9.5
CVSS
7.1 (high)
Published
2023-09-26
Title
Welcart e-Commerce < 2.8.22 - Author+ SQL Injection
Fixed in
Fixed in 2.8.22
CVSS
6.5 (medium)
Published
2023-09-26
Title
Welcart e-Commerce < 2.8.22 - Author+ Path Traversal
Fixed in
Fixed in 2.8.22
CVSS
4.3 (medium)
Published
2023-09-26
Title
Welcart e-Commerce < 2.8.22 - Editor+ SQL Injection
Fixed in
Fixed in 2.8.22
CVSS
5.4 (medium)
Published
2023-09-26
Title
Welcart e-Commerce < 2.8.22 - Multiple XSS
Fixed in
Fixed in 2.8.22
CVSS
6.1 (medium)
Published
2023-09-26
Title
Welcart e-Commerce < 2.8.22 - Editor+ Arbitrary File Upload
Fixed in
Fixed in 2.8.22
CVSS
2.7 (low)
Published
2023-01-27
Title
Welcart e-Commerce < 2.8.11 - Reflected XSS
Fixed in
Fixed in 2.8.11
CVSS
7.5 (high)
Published
2022-12-23
Title
Welcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 2.8.9
CVSS
6.8 (medium)
Published
2022-12-05
Title
Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access
Fixed in
Fixed in 2.8.5
CVSS
8.6 (high)
Published
2022-12-05
Title
Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation
Fixed in
Fixed in 2.8.6
CVSS
7.5 (high)
Published
2022-12-05
Title
Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access
Fixed in
Fixed in 2.8.5
CVSS
7.7 (high)
Published
2022-11-21
Title
Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion
Fixed in
Fixed in 2.8.4
CVSS
5.4 (medium)
Published
2022-11-21
Title
Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.4
CVSS
6.4 (medium)
Published
2022-10-20
Title
Welcart eCommerce < 2.7.8 - Unauthenticated Arbitrary File Access
Fixed in
Fixed in 2.7.8
CVSS
8.6 (high)
Published
2021-08-06
Title
Welcart e-Commerce < 2.2.8 - Unauthenticated Information Disclosure
Fixed in
Fixed in 2.2.8
CVSS
7.5 (high)
Published
2021-08-06
Title
Welcart e-Commerce < 2.2.8 - Authenticated System Information Disclosure
Fixed in
Fixed in 2.2.8
CVSS
4.3 (medium)
Published
2021-06-11
Title
Welcart e-Commerce < 2.2.4 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.2.4
CVSS
6.1 (medium)
Published
2021-02-08
Title
Welcart e-Commerce < 2.1.1 - Authenticated SQL Injection
Fixed in
Fixed in 2.1.1
CVSS
6.7 (medium)
Published
2020-11-05
Title
Welcart e-Commerce < 1.9.36 - Authenticated PHP Object Injection
Fixed in
Fixed in 1.9.36
CVSS
7.5 (high)
Published
2016-06-24
Title
Welcart e-Commerce < 1.8.3 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.8.3
CVSS
6.1 (medium)
Published
2016-06-24
Title
Welcart e-Commerce < 1.8.3 - PHP Object Injection
Fixed in
Fixed in 1.8.3
CVSS
5.6 (medium)
Published
2016-06-24
Title
Welcart e-Commerce < 1.8.3 - Session Management
Fixed in
Fixed in 1.8.3
CVSS
6.5 (medium)
Published
2015-12-17
Title
Welcart e-Commerce < 1.5.3 - SQL Injection
Fixed in
Fixed in 1.5.3
CVSS
6.3 (medium)
Published
2015-07-15
Title
Welcart e-Commerce < 1.4.18 - Multiple Vulnerabilities
Fixed in
Fixed in 1.4.18
CVSS
3.4 (low)
Published
2014-08-01
Title
Welcart e-Commerce 1.3.12 - purchase_limit Parameter DOM-based XSS
Fixed in
Fixed in 1.5
CVSS
6.1 (medium)
Published
2014-08-01
Title
Welcart e-Commerce 1.3.12 - DOM Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.5
CVSS
6.1 (medium)
Published
2014-08-01
Title
Welcart e-Commerce 1.3.12 - SQL Injection
Fixed in
Fixed in 1.5
CVSS
9.0 (critical)