VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Welcart e-Commerce security & vulnerabilities

usc-e-shop— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 65 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
65Known vulnerabilities
  • Critical3
  • High27
  • Medium35
  • Low0
Vulnerabilities per year
2012: 2 vulnerabilities2122014: 2 vulnerabilities2142015: 2 vulnerabilities2152016: 4 vulnerabilities4162020: 1 vulnerability1202021: 4 vulnerabilities4212022: 9 vulnerabilities9222023: 11 vulnerabilities11232024: 2 vulnerabilities2242025: 10 vulnerabilities10252026: 18 vulnerabilities1826

All Welcart e-Commerce vulnerabilities

Welcart e-Commerce vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.12.6Update to 2.12.7
CVE-2026-119505
Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤2.12.6Update to 2.12.7
CVE-2026-119503
Medium5.3Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
≤2.12.5Update to 2.12.6
CVE-2026-119166
High7.2Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
≤2.12.5Update to 2.12.6
CVE-2026-118070
Medium4.3Missing Authorization
<2.12.6Update to 2.12.6
CVE-2026-111032
Medium4.9Authenticated (Editor+) SQL Injection
<2.12.6Update to 2.12.6
CVE-2026-111027
Medium4.7Unauthenticated Open Redirect
<2.12.6Update to 2.12.6
CVE-2026-111031
Medium4.9Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
≤2.12.4Update to 2.12.5
CVE-2026-107752
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.12.3Update to 2.12.4
CVE-2026-96761
High7.2Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
≤2.12.2Update to 2.12.3
CVE-2026-87091
High8.8Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
≤2.12.1Update to 2.12.2
CVE-2026-19887
High7.2Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
≤2.12.1Update to 2.12.2
CVE-2026-19914
Medium6.5Unauthenticated Session Fixation
<2.12.1Update to 2.12.1
CVE-2025-15671
Medium5.3Unauthenticated Payment Bypass
<2.11.33Update to 2.11.33
CVE-2026-15213
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.11.31Update to 2.11.32
CVE-2026-27539
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤2.11.33Update to 2.11.34
CVE-2026-16066
Medium4.9Authenticated (Editor+) SQL Injection
≤2.11.31Update to 2.11.32
CVE-2026-16065
Medium5.3Missing Authorization
≤2.11.28Update to 2.11.29
CVE-2026-49775
Medium5.3Missing Authorization to Unauthenticated Information Exposure
≤2.11.24Update to 2.11.25
CVE-2025-12979
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting via order_mail
≤2.11.22Update to 2.11.23
CVE-2025-10651
Medium4.3Missing Authorization
≤2.11.24Update to 2.11.25
CVE-2025-62953
Medium6.5Authenticated (Author+) SQL Injection via Cookie
≤2.11.21Update to 2.11.22
CVE-2025-10649
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
≤2.11.20Update to 2.11.21
CVE-2025-9367
Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤2.11.20Update to 2.11.21
CVE-2025-58984
Medium6.6Authenticated (Editor+) PHP Object Injection
≤2.11.16Update to 2.11.17
CVE-2025-54012
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
≤2.11.16Update to 2.11.17
CVE-2025-54013
Medium6.5Authenticated (Editor+) Arbitrary File Deletion
≤2.11.13Update to 2.11.14
CVE-2025-47511
High7.2Unauthenticated Stored Cross-Site Scripting via name Parameter
≤2.11.9Update to 2.11.10
CVE-2025-0511
Medium4.9Authenticated (Admin+) SQL Injection
≤2.11.1Update to 2.11.2
CVE-2024-42404
Medium5.4Missing Authorization
≤2.9.14Update to 2.10.0
CVE-2024-32144
High7.2Authenticated(Editor+) SQL Injection
<2.9.4Update to 2.9.4
CVE-2023-50847
Medium4.1Authenticated (Administrator+) Directory Traversal
≤2.9.6Update to 2.9.7
CVE-2023-6120
High7.2Authenticated (Administrator+) PHP Object Injection
<2.9.6Update to 2.9.6
—
High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤2.9.4Update to 2.9.5
CVE-2023-5953
High8.8Cross-Site Request Forgery
≤2.9.4Update to 2.9.5
—
Critical9.8Unauthenticated PHP Object Injection
≤2.9.4Update to 2.9.5
CVE-2023-5952
Medium6.1Reflected Cross-Site Scripting
≤2.9.4Update to 2.9.5
CVE-2023-5951
High8.8Authenticated(Editor+) Arbitrary File Upload
≤2.8.21Update to 2.8.22
CVE-2023-40219
High8.8Authenticated(Editor+) SQL Injection
<2.8.22Update to 2.8.22
CVE-2023-43610
High8.8Authenticated(level_5+) SQL Injection via get_logs
<2.8.22Update to 2.8.22
CVE-2023-43493
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.10Update to 2.8.11
CVE-2023-22705
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤2.8.8Update to 2.8.9
CVE-2022-4655
Medium6.5Authenticated (Subscriber+) Arbitrary File Read
≤2.8.4Update to 2.8.5
CVE-2022-4236
Medium6.5Authenticated (Subscriber+) Information Disclosure and PHAR deserialization
≤2.8.5Update to 2.8.6
CVE-2022-4237
High7.5Information Disclosure via Arbitrary File Read
2.6.10 – 2.8.4Update to 2.8.5
CVE-2022-4140
High8.8Cross-Site Request Forgery
≤2.8.3Update to 2.8.4
—
Medium5.4Missing Authorization
≤2.8.3Update to 2.8.4
CVE-2022-3946
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.8.3Update to 2.8.4
CVE-2022-3935
High8.8Cross-Site Request Forgery
≤2.8.3Update to 2.8.4
—
High7.5Information Disclosure via Arbitrary File Read
2.6.0 – 2.7.7Update to 2.7.8
CVE-2022-41840
High7.5Missing Capabilities Check to Information Disclosure
<2.2.8Update to 2.2.8
CVE-2021-4355
Medium4.3Missing Capabilities Check to Information Disclosure
<2.2.8Update to 2.2.8
CVE-2021-4375
Medium6.1Reflected Cross-Site Scripting
≤2.2.3Update to 2.2.4
CVE-2021-20734
High8.8SQL Injection
≤2.1.0Update to 2.1.1
—
High7.5PHP Object Injection
<1.9.36Update to 1.9.36
CVE-2020-28339
Medium6.1Cross-Site Scripting
≤1.8.2Update to 1.8.3
CVE-2016-4827
High8.1Object Injection
<1.8.3Update to 1.8.3
CVE-2016-4825
Critical9.8Authentication Bypass
≤1.8.2Update to 1.8.3
CVE-2016-4828
Medium6.1Reflected Cross-Site Scripting
<1.8.3Update to 1.8.3
CVE-2016-4826
High8.8SQL Injection
<1.5.3Update to 1.5.3
CVE-2015-7791
High7.1Multiple Cross-Site Scripting
<1.4.18Update to 1.4.18
CVE-2015-2973
Critical9.8SQL Injection
≤2.9.1Update to 2.9.2
CVE-2014-10017
Medium6.1Cross-Site Scripting
≤2.11.1Update to 2.11.2
CVE-2014-10016
Medium6.1Cross-Site Scripting
<1.2.2Update to 1.2.2
CVE-2012-5177
High8.8Cross-Site Request Forgery
<1.2.2Update to 1.2.2
CVE-2012-5178

Welcart e-Commerce: common questions

Does Welcart e-Commerce have known vulnerabilities?

Yes. VulnCrest Radar lists 65 known vulnerabilities in Welcart e-Commerce: 3 critical, 27 high, 35 medium. None are known to affect version null.

How do I check which version of Welcart e-Commerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Welcart e-Commerce vulnerability?

CVE-2026-119505, published Nov 7, 2026: Welcart e-Commerce <= 2.12.6 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any Welcart e-Commerce vulnerability listed in CISA KEV?

No. None of the known Welcart e-Commerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?