Skip to contentNanbu Welcart E-commerce vulnerabilities
- nanbu welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1195057.1 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerabilityCVE-2026-1195036.5 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' ParameterCVE-2026-1191665.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' ParameterCVE-2026-1180707.2 High
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajaxCVE-2026-1110323.8 Low
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' ParameterCVE-2026-1110314.7 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' ParameterCVE-2026-1110276.8 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookieCVE-2026-1077524.9 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-967617.1 High
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification ParametersCVE-2026-870917.2 High
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY CallbackCVE-2026-198878.8 High
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' ParameterCVE-2026-199147.2 High
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.1 - Session Fixation via uscesid ParameterCVE-2025-156715.4 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-275397.1 High
- nanbu welcart e-commerceWelcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement CallbackCVE-2026-152135.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product NameCVE-2026-160665.4 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV ImportCVE-2026-160656.5 Medium
- info@welcart welcart e-commerceWordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerabilityCVE-2026-497756.5 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information ExposureCVE-2025-129795.3 Medium
- info@welcart welcart e-commerceWordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerabilityCVE-2025-629534.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mailCVE-2025-106515.5 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via CookieCVE-2025-106496.5 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site ScriptingCVE-2025-93675.5 Medium
- info@welcart welcart e-commerceWordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-589845.9 Medium
- info@welcart welcart e-commerceWordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection VulnerabilityCVE-2025-540127.2 High
- info@welcart welcart e-commerceWordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-540135.9 Medium
- info@welcart welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion VulnerabilityCVE-2025-475116.8 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization...CVE-2025-271306.3 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name ParameterCVE-2025-05117.2 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this...CVE-2024-453666.1 Medium
- collne welcart, nanbu welcart e-commerce, welcart e-commerce +2 moreSQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can...CVE-2024-424048.8 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.9.14 - Broken Access Control vulnerabilityCVE-2024-321445.4 Medium
- collne inc. welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL InjectionCVE-2023-508477.6 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory TraversalCVE-2023-61204.1 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Reflected XSSCVE-2023-59516.1 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File UploadCVE-2023-59538.8 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Unauthenticated PHP Object InjectionCVE-2023-59529.8 Critical
- collne inc. welcart e-commerce, welcart e-commerce +1 moreCross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to...CVE-2023-436146.1 Medium
- collne inc. welcart e-commerce, welcart e-commerce +1 moreSQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21...CVE-2023-436108.8 High
- collne inc. welcart e-commerce, welcart e-commerce +1 moreSQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows...CVE-2023-434934.9 Medium
- collne inc. welcart e-commerce, welcart e-commerce +1 moreCross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21...CVE-2023-434846.1 Medium
- collne inc. welcart e-commerce, welcart e-commerce +1 moreCross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce...CVE-2023-419626.1 Medium
- collne inc. welcart e-commerce, welcart e-commerce +1 moreCross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce...CVE-2023-412336.1 Medium
- collne welcart, collne inc. welcart e-commerce +1 morePath traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with...CVE-2023-405324.3 Medium
- coline welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload...CVE-2023-402197.2 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information DisclosureCVE-2021-43754.3 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information DisclosureCVE-2021-43557.5 High
- collne inc. welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)CVE-2023-227057.1 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via ShortcodeCVE-2022-46555.4 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.6 - Subscriber+ PHAR DeserialisationCVE-2022-42378.8 High
- Show moreLoading…