Skip to content

Unknown Welcart E-commerce vulnerabilities

nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajaxCVE-2026-1110323.8 LowOctober 28, 2026
nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' ParameterCVE-2026-1110314.7 MediumOctober 28, 2026
nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' ParameterCVE-2026-1110276.8 MediumOctober 28, 2026
nanbu welcart e-commerceWelcart e-Commerce < 2.12.1 - Session Fixation via uscesid ParameterCVE-2025-156715.4 MediumAugust 21, 2026
nanbu welcart e-commerceWelcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement CallbackCVE-2026-152135.3 MediumAugust 12, 2026
nanbu welcart e-commerceWelcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product NameCVE-2026-160665.4 MediumAugust 12, 2026
nanbu welcart e-commerceWelcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV ImportCVE-2026-160656.5 MediumAugust 6, 2026
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Reflected XSSCVE-2023-59516.1 MediumDecember 4, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File UploadCVE-2023-59538.8 HighDecember 4, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Unauthenticated PHP Object InjectionCVE-2023-59529.8 CriticalDecember 4, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via ShortcodeCVE-2022-46555.4 MediumJanuary 16, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.6 - Subscriber+ PHAR DeserialisationCVE-2022-42378.8 HighJanuary 2, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File AccessCVE-2022-42366.5 MediumJanuary 2, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File AccessCVE-2022-4140Public exploit7.5 HighJanuary 2, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/DeletionCVE-2022-39466.5 MediumDecember 12, 2022
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site ScriptingCVE-2022-39355.4 MediumDecember 12, 2022