Unknown Welcart E Commerce vulnerabilities
13 vulnerabilities
Known vulnerabilities in Unknown Welcart E Commerce, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-15671unknownwelcart e-commerce+1
EPSS score0.30%
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.CVE-2022-4655unknownwelcart e-commerce+2EPSS score0.47%
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.CVE-2022-4140unknownwelcart e-commerce+2EPSS score2.97%
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the serverCVE-2022-4236unknownwelcart e-commerce+2EPSS score0.80%
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.CVE-2022-4237unknownwelcart e-commerce+2EPSS score1.08%
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blogCVE-2022-3935unknownwelcart e-commerce+2EPSS score0.49%
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacksCVE-2022-3946unknownwelcart e-commerce+2EPSS score0.34%
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.CVE-2026-16066unknownwelcart e-commerce+1EPSS score0.23%
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.CVE-2026-16065unknownwelcart e-commerce+1EPSS score0.40%
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.CVE-2026-15213unknownwelcart e-commerce+1EPSS score0.16%
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.CVE-2023-5952unknownwelcart e-commerce+2EPSS score1.25%
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blogCVE-2023-5953unknownwelcart e-commerce+2EPSS score0.48%
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the serverCVE-2023-5951unknownwelcart e-commerce+2EPSS score0.47%
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin