VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Welcart e-Commerce security & vulnerabilities

usc-e-shop— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 65 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
65Known vulnerabilities
  • Critical3
  • High27
  • Medium35
  • Low0
Vulnerabilities per year
2012: 2 vulnerabilities2122014: 2 vulnerabilities2142015: 2 vulnerabilities2152016: 4 vulnerabilities4162020: 1 vulnerability1202021: 4 vulnerabilities4212022: 9 vulnerabilities9222023: 11 vulnerabilities11232024: 2 vulnerabilities2242025: 10 vulnerabilities10252026: 18 vulnerabilities1826

All Welcart e-Commerce vulnerabilities

Welcart e-Commerce vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.12.6Update to 2.12.7
CVE-2026-119505
High7.2Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
≤2.12.5Update to 2.12.6
CVE-2026-118070
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.12.3Update to 2.12.4
CVE-2026-96761
High7.2Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
≤2.12.2Update to 2.12.3
CVE-2026-87091
High8.8Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
≤2.12.1Update to 2.12.2
CVE-2026-19887
High7.2Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
≤2.12.1Update to 2.12.2
CVE-2026-19914
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.11.31Update to 2.11.32
CVE-2026-27539
High7.2Unauthenticated Stored Cross-Site Scripting via name Parameter
≤2.11.9Update to 2.11.10
CVE-2025-0511
High7.2Authenticated(Editor+) SQL Injection
<2.9.4Update to 2.9.4
CVE-2023-50847
High7.2Authenticated (Administrator+) PHP Object Injection
<2.9.6Update to 2.9.6
—
High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤2.9.4Update to 2.9.5
CVE-2023-5953
High8.8Cross-Site Request Forgery
≤2.9.4Update to 2.9.5
—
Critical9.8Unauthenticated PHP Object Injection
≤2.9.4Update to 2.9.5
CVE-2023-5952
High8.8Authenticated(Editor+) Arbitrary File Upload
≤2.8.21Update to 2.8.22
CVE-2023-40219
High8.8Authenticated(Editor+) SQL Injection
<2.8.22Update to 2.8.22
CVE-2023-43610
High8.8Authenticated(level_5+) SQL Injection via get_logs
<2.8.22Update to 2.8.22
CVE-2023-43493
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.10Update to 2.8.11
CVE-2023-22705
High7.5Information Disclosure via Arbitrary File Read
2.6.10 – 2.8.4Update to 2.8.5
CVE-2022-4140
High8.8Cross-Site Request Forgery
≤2.8.3Update to 2.8.4
—
High8.8Cross-Site Request Forgery
≤2.8.3Update to 2.8.4
—
High7.5Information Disclosure via Arbitrary File Read
2.6.0 – 2.7.7Update to 2.7.8
CVE-2022-41840
High7.5Missing Capabilities Check to Information Disclosure
<2.2.8Update to 2.2.8
CVE-2021-4355
High8.8SQL Injection
≤2.1.0Update to 2.1.1
—
High7.5PHP Object Injection
<1.9.36Update to 1.9.36
CVE-2020-28339
High8.1Object Injection
<1.8.3Update to 1.8.3
CVE-2016-4825
Critical9.8Authentication Bypass
≤1.8.2Update to 1.8.3
CVE-2016-4828
High8.8SQL Injection
<1.5.3Update to 1.5.3
CVE-2015-7791
High7.1Multiple Cross-Site Scripting
<1.4.18Update to 1.4.18
CVE-2015-2973
Critical9.8SQL Injection
≤2.9.1Update to 2.9.2
CVE-2014-10017
High8.8Cross-Site Request Forgery
<1.2.2Update to 1.2.2
CVE-2012-5178

Welcart e-Commerce: common questions

Does Welcart e-Commerce have known vulnerabilities?

Yes. VulnCrest Radar lists 65 known vulnerabilities in Welcart e-Commerce: 3 critical, 27 high, 35 medium. None are known to affect version null.

How do I check which version of Welcart e-Commerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Welcart e-Commerce vulnerability?

CVE-2026-119505, published Nov 7, 2026: Welcart e-Commerce <= 2.12.6 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any Welcart e-Commerce vulnerability listed in CISA KEV?

No. None of the known Welcart e-Commerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?