Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-03
Welcart e-Commerce - Security Vulnerability (CVE-2026-120597)
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of…
PLUGIN
Welcart e-Commerce
CVE-2026-120597
Risk Score
Threat Entry
Updated 2026-11-02
Welcart e-Commerce - Security Vulnerability (CVE-2026-118070)
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is staged by an unauthenticated visitor who forges the ROBOT PAYMENT browser-return request, storing the malicious gid value in order metadata; the script then fires when an administrator opens that order in…
PLUGIN
Welcart e-Commerce
CVE-2026-118070
Risk Score
Threat Entry
Updated 2026-11-03
Welcart e-Commerce - Security Vulnerability (CVE-2026-119166)
The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form,…
PLUGIN
Welcart e-Commerce
CVE-2026-119166
Risk Score
Threat Entry
Updated 2026-10-06
Welcart e-Commerce - Security Vulnerability (CVE-2026-87091)
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endpoint accepts the 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification, meaning any unauthenticated attacker can directly submit malicious payloads that are stored and later rendered in the…
PLUGIN
Welcart e-Commerce
CVE-2026-87091
Risk Score
Threat Entry
Updated 2026-09-08
Welcart E Commerce - Remote Code Execution (CVE-2026-19887)
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or…
PLUGIN
Welcart E Commerce
CVE-2026-19887
Risk Score
Threat Entry
Updated 2026-09-01
Welcart e-Commerce - Cross-Site Scripting (XSS) (CVE-2026-19914)
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is delivered via the guest checkout form, requiring no authentication, and executes when an administrator views the affected order in the WordPress admin panel.
PLUGIN
Welcart e-Commerce
CVE-2026-19914
Risk Score
Threat Entry
Updated 2026-08-26
Welcart e-Commerce - Security Vulnerability (CVE-2025-15671)
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
PLUGIN
Welcart e-Commerce
CVE-2025-15671
Risk Score
Threat Entry
Updated 2026-10-23
Welcart e-Commerce - Cross-Site Scripting (XSS) (CVE-2026-27539)
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce
PLUGIN
Welcart e-Commerce
CVE-2026-27539
Risk Score
Threat Entry
Updated 2026-08-26
Welcart e-Commerce - Security Vulnerability (CVE-2026-15213)
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
PLUGIN
Welcart e-Commerce
CVE-2026-15213
Risk Score
Threat Entry
Updated 2026-08-26
Welcart e-Commerce - Cross-Site Scripting (XSS) (CVE-2026-16066)
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
PLUGIN
Welcart e-Commerce
CVE-2026-16066
Risk Score
Threat Entry
Updated 2026-08-26
Welcart e-Commerce - SQL Injection (CVE-2026-16065)
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.
PLUGIN
Welcart e-Commerce
CVE-2026-16065
Risk Score
Threat Entry
Updated 2026-06-17
Welcart e-Commerce - Broken Access Control (CVE-2026-49775)
Unauthenticated Broken Access Control in Welcart e-Commerce
PLUGIN
Welcart e-Commerce
CVE-2026-49775
Risk Score
Threat Entry
Updated 2026-06-17
Welcart e-Commerce - Broken Access Control (CVE-2025-12979)
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials (ex. PayPal api secret) , as well as business contact details, mail templates, and other operational settings tied to the store.
PLUGIN
Welcart e-Commerce
CVE-2025-12979
Risk Score
Threat Entry
Updated 2026-06-17
Welcart e-Commerce - Cross-Site Scripting (XSS) (CVE-2025-10651)
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22. This is due to insufficient sanitization on the order_mail field and a lack of escaping on output. This makes it possible for authenticated attackers, with Editor-level permissions and above, to inject arbitrary web scripts via the General Setting page that will execute when an administrator accesses the E-mail Setting page.
PLUGIN
Welcart e-Commerce
CVE-2025-10651
Risk Score
Threat Entry
Updated 2026-06-17
Welcart e-Commerce - SQL Injection (CVE-2025-10649)
The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Welcart e-Commerce
CVE-2025-10649
Risk Score
Threat Entry
Updated 2026-06-17
Welcart e-Commerce - Cross-Site Scripting (XSS) (CVE-2025-9367)
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Welcart e-Commerce
CVE-2025-9367
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Path Traversal (CVE-2025-47511)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through
PLUGIN
Welcart E Commerce
CVE-2025-47511
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Scripting (XSS) (CVE-2025-0511)
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Welcart E Commerce
CVE-2025-0511
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Broken Access Control (CVE-2024-32144)
Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14.
PLUGIN
Welcart E Commerce
CVE-2024-32144
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - SQL Injection (CVE-2023-50847)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.
PLUGIN
Welcart E Commerce
CVE-2023-50847
Risk Score