Welcart vulnerabilities, page 2
42 vulnerabilities
Known vulnerabilities in Welcart products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
CVE-2022-3935unknownwelcart e-commerce+2
EPSS score0.49%
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacksCVE-2022-3946unknownwelcart e-commerce+2EPSS score0.34%
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.CVE-2012-5177welcartwelcart_plugin+1EPSS score1.95%
Cross-site scripting (XSS) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2012-5178welcartwelcart_plugin+1EPSS score1.07%
Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that complete a purchase.CVE-2024-42404welcart inc.welcart e-commerce+2EPSS score0.48%
SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database.CVE-2024-45366welcart inc.welcart e-commerce+1EPSS score0.26%
Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.CVE-2024-32144welcart inc.welcart e-commerce+2EPSS score0.34%
Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14.CVE-2026-27539welcartwelcart_e-commerce+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.CVE-2026-96761welcartwelcart_e-commerce+1EPSS score0.14%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.CVE-2023-40219collne inc.welcart e-commerce+2EPSS score1.24%
Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory.CVE-2023-41233collne inc.welcart e-commerce+1EPSS score0.73%
Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.CVE-2023-41962collne inc.welcart e-commerce+1EPSS score0.73%
Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page.CVE-2023-43614collne inc.welcart e-commerce+1EPSS score0.80%
Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.CVE-2023-43484collne inc.welcart e-commerce+1EPSS score0.80%
Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.CVE-2023-43610collne inc.welcart e-commerce+2EPSS score1.19%
SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations.CVE-2023-43493collne inc.welcart e-commerce+2EPSS score0.98%
SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information.CVE-2023-5952unknownwelcart e-commerce+2EPSS score1.25%
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blogCVE-2023-5953unknownwelcart e-commerce+2EPSS score0.48%
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the serverCVE-2023-5951unknownwelcart e-commerce+2EPSS score0.47%
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminCVE-2023-22705collne inc.welcart e-commerce+2EPSS score0.43%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions.