Skip to content

Uscnanbu Welcart E-commerce vulnerabilities

nanbu welcart e-commerceWelcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' ParameterCVE-2026-1191665.3 MediumOctober 31, 2026
nanbu welcart e-commerceWelcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' ParameterCVE-2026-1180707.2 HighOctober 31, 2026
nanbu welcart e-commerceWelcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookieCVE-2026-1077524.9 MediumOctober 17, 2026
nanbu welcart e-commerceWelcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification ParametersCVE-2026-870917.2 HighOctober 3, 2026
nanbu welcart e-commerceWelcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY CallbackCVE-2026-198878.8 HighSeptember 5, 2026
nanbu welcart e-commerceWelcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' ParameterCVE-2026-199147.2 HighSeptember 1, 2026
nanbu welcart e-commerceWelcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information ExposureCVE-2025-129795.3 MediumNovember 13, 2025
nanbu welcart e-commerceWelcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mailCVE-2025-106515.5 MediumOctober 22, 2025
nanbu welcart e-commerceWelcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via CookieCVE-2025-106496.5 MediumOctober 8, 2025
nanbu welcart e-commerceWelcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site ScriptingCVE-2025-93675.5 MediumSeptember 10, 2025
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name ParameterCVE-2025-05117.2 HighFebruary 12, 2025
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory TraversalCVE-2023-61204.1 MediumDecember 9, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information DisclosureCVE-2021-43754.3 MediumJune 7, 2023
nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information DisclosureCVE-2021-43557.5 HighJune 7, 2023