Skip to content
Noroxi

Welcart e-Commerce

usc-e-shop · plugin

Known security vulnerabilities for Welcart e-Commerce. Find out in seconds which version runs on your site with WP Lens.

20 known vulnerabilities

1 critical · 1 with public exploit code · latest Sep 5, 2026

Vulnerabilities

  • CVE-2022-41840

    WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability

    Critical 9.8

  • CVE-2026-19887

    Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

    High 8.8

  • CVE-2020-28339

    The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize.

    High 8.8

  • CVE-2026-19914

    Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter

    High 7.2

  • CVE-2025-54012

    WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability

    High 7.2

  • CVE-2023-50847

    WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL Injection

    High 7.2

  • CVE-2026-27539

    WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-49775

    WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2025-10649

    Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie

    Medium 6.5

  • CVE-2025-47511

    WordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability

    Medium 6.5

  • CVE-2025-0511

    Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter

    Medium 6.1

  • CVE-2023-22705

    WordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2025-58984

    WordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) Vulnerability

    Medium 5.9

  • CVE-2025-54013

    WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability

    Medium 5.9

  • CVE-2025-10651

    Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail

    Medium 5.5

  • CVE-2025-9367

    Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting

    Medium 5.5

  • CVE-2025-12979

    Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure

    Medium 5.3

  • CVE-2025-62953

    WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2024-32144

    WordPress Welcart e-Commerce plugin <= 2.9.14 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2023-6120

    Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal

    Low 2.7

← Back to directory