Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Path Traversal (CVE-2023-6120)
The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server.
PLUGIN
Welcart E Commerce
CVE-2023-6120
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - PHP Object Injection (CVE-2023-5952)
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
PLUGIN
Welcart E Commerce
CVE-2023-5952
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Request Forgery (CSRF) (CVE-2023-5953)
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server
PLUGIN
Welcart E Commerce
CVE-2023-5953
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Scripting (XSS) (CVE-2023-5951)
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Welcart E Commerce
CVE-2023-5951
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Broken Access Control (CVE-2021-4375)
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information() function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPress settings, plugin settings, PHP settings and server settings.
PLUGIN
Welcart E Commerce
CVE-2021-4375
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Broken Access Control (CVE-2021-4355)
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.
PLUGIN
Welcart E Commerce
CVE-2021-4355
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Scripting (XSS) (CVE-2023-22705)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin
PLUGIN
Welcart E Commerce
CVE-2023-22705
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Scripting (XSS) (CVE-2022-4655)
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
PLUGIN
Welcart E Commerce
CVE-2022-4655
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - PHP Object Injection (CVE-2022-4237)
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
PLUGIN
Welcart E Commerce
CVE-2022-4237
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Improper Input Validation (CVE-2022-4140)
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
PLUGIN
Welcart E Commerce
CVE-2022-4140
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Improper Input Validation (CVE-2022-4236)
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
PLUGIN
Welcart E Commerce
CVE-2022-4236
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Request Forgery (CSRF) (CVE-2022-3946)
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
PLUGIN
Welcart E Commerce
CVE-2022-3946
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Scripting (XSS) (CVE-2022-3935)
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
PLUGIN
Welcart E Commerce
CVE-2022-3935
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Path Traversal (CVE-2022-41840)
Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin
PLUGIN
Welcart E Commerce
CVE-2022-41840
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - PHP Object Injection (CVE-2020-28339)
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain.
PLUGIN
Welcart E Commerce
CVE-2020-28339
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Security Vulnerability (CVE-2016-4828)
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
PLUGIN
Welcart E Commerce
CVE-2016-4828
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Scripting (XSS) (CVE-2016-4827)
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
PLUGIN
Welcart E Commerce
CVE-2016-4827
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - Cross-Site Scripting (XSS) (CVE-2016-4826)
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.
PLUGIN
Welcart E Commerce
CVE-2016-4826
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - PHP Object Injection (CVE-2016-4825)
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.
PLUGIN
Welcart E Commerce
CVE-2016-4825
Risk Score
Threat Entry
Updated 2026-06-17
Welcart E Commerce - SQL Injection (CVE-2015-7791)
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
PLUGIN
Welcart E Commerce
CVE-2015-7791
Risk Score