WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
usc-e-shop
Published
2025-09-09
Title
Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
usc-e-shop
Published
2025-10-07
Title
Welcart e-Commerce < 2.11.22 - Authenticated (Author+) SQL Injection via Cookie
Slug
usc-e-shop
Published
2025-10-21
Title
Welcart e-Commerce < 2.11.23 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail
Slug
usc-e-shop
Published
2025-10-14
Title
Welcart e-Commerce < 2.11.25 - Missing Authorization
Slug
usc-e-shop
Published
2025-11-12
Title
Welcart e-Commerce < 2.11.25 - Missing Authorization to Unauthenticated Information Exposure
Slug
usc-e-shop
Published
2026-06-04
Title
Welcart e-Commerce < 2.11.29 - Missing Authorization
Slug
usc-e-shop
Published
2026-07-31
Title
Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
Slug
usc-e-shop
Published
2026-08-10
Title
Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
Slug
usc-e-shop
Published
2026-08-11
Title
Welcart e-Commerce < 2.11.32 - Unauthenticated Stored Cross-Site Scripting
Slug
usc-e-shop
Published
2026-08-10
Title
Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback
Slug
usc-e-shop
Published
2026-08-19
Title
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
Slug
usc-e-shop
Published
2026-08-31
Title
Welcart e-Commerce < 2.12.2 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
Slug
usc-e-shop
Published
2026-09-04
Title
Welcart e-Commerce < 2.12.2 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
Slug
usc-e-shop
Published
2026-10-03
Title
Welcart e-Commerce < 2.12.4 - Unauthenticated Stored Cross-Site Scripting
Slug
usc-e-shop
Published
2026-10-02
Title
Welcart e-Commerce < 2.12.3 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
Slug
usc-e-shop
Published
2026-10-16
Title
Welcart e-Commerce < 2.12.5 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
Slug
usc-e-shop
Published
2026-10-26
Title
Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter
Slug
usc-e-shop
Published
2026-10-26
Title
Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter
Slug
usc-e-shop
Published
2026-10-26
Title
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
Slug
usc-e-shop
Published
2026-10-30
Title
Welcart e-Commerce < 2.12.6 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
Slug
usc-e-shop
Published
2026-10-30
Title
Welcart e-Commerce < 2.12.6 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
Slug
use-any-font
Published
2022-01-31
Title
Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending
Slug
use-any-font
Published
2022-03-30
Title
Use Any Font < 6.2.1 - API Key Deactivation via CSRF
Slug
use-any-font
Published
2024-09-25
Title
Use Any Font < 6.3.09 - Cross-Site Request Forgery
Slug
use-memcached
Published
2023-09-04
Title
Use Memcached <= 1.0.5 - Settings Update via CSRF