Browse CVEs

MEDIUM 6.5 CVE-2025-47511 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Pat… Welcart E Commerce 2.11.14+ Fix from $1,6002025-06-09 HIGH 8.8 CVE-2025-27130 Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrar… Welcart E Commerce after 2.11.6 Fix from $1,9502025-04-01 MEDIUM 6.1 CVE-2025-0511 The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and includin… Welcart E Commerce 2.11.10+ Fix from $1,6002025-02-12 HIGH 8.8 CVE-2024-42404 SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information … Welcart E Commerce 2.11.2+ Fix from $1,9502024-09-18 MEDIUM 6.1 CVE-2024-45366 Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be exec… Welcart E Commerce 2.11.2+ Fix from $1,6002024-09-18 HIGH 7.2 CVE-2023-50847 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affec… Welcart E Commerce after 2.9.3 Fix from $1,9502023-12-28 CRITICAL 9.8 CVE-2023-5952 The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Obj… Welcart E Commerce 2.9.5+ Fix from $2,3002023-12-04 HIGH 8.8 CVE-2023-5953 The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJ… Welcart E Commerce 2.9.5+ Fix from $1,9502023-12-04 MEDIUM 6.1 CVE-2023-5951 The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… Welcart E Commerce 2.9.5+ Fix from $1,6002023-12-04 HIGH 8.8 CVE-2023-43610 SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority… Welcart E Commerce after 2.8.21 Fix from $1,9502023-09-27 MEDIUM 6.1 CVE-2023-43484 Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject … Welcart E Commerce after 2.8.21 Fix from $1,6002023-09-27 MEDIUM 6.1 CVE-2023-43614 Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to i… Welcart E Commerce after 2.8.21 Fix from $1,6002023-09-27 MEDIUM 6.1 CVE-2023-41962 Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated att… Welcart E Commerce after 2.8.21 Fix from $1,6002023-09-27 MEDIUM 6.1 CVE-2023-41233 Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticate… Welcart E Commerce after 2.8.21 Fix from $1,6002023-09-27 HIGH 7.2 CVE-2023-40219 Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory. Welcart E Commerce after 2.8.21 Fix from $1,9502023-09-27 MEDIUM 5.3 CVE-2021-4355 The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list()… Welcart E Commerce after 2.2.7 Fix from $1,6002023-06-07 MEDIUM 6.1 CVE-2023-22705 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions. Welcart E Commerce after 2.8.10 Fix from $1,6002023-03-29 MEDIUM 5.4 CVE-2022-4655 The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a ro… Welcart E Commerce 2.8.9+ Fix from $1,6002023-01-16 HIGH 8.8 CVE-2022-4237 The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions … Welcart E Commerce 2.8.6+ Fix from $1,9502023-01-02 HIGH 7.5 CVE-2022-4140 The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow … Welcart E Commerce 2.8.5+ Fix from $1,9502023-01-02 MEDIUM 6.5 CVE-2022-4236 The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action … Welcart E Commerce 2.8.5+ Fix from $1,6002023-01-02 MEDIUM 6.5 CVE-2022-3946 The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, u… Welcart E Commerce 2.8.4+ Fix from $1,6002022-12-12 MEDIUM 5.4 CVE-2022-3935 The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as… Welcart E Commerce 2.8.4+ Fix from $1,6002022-12-12 CRITICAL 9.8 CVE-2022-41840EPSS 5% Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. Welcart E Commerce 2.7.8+ Fix from $2,3002022-11-18 MEDIUM 6.1 CVE-2021-20734 Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspe… Welcart E Commerce Mitigation only Fix from $1,6002021-06-22 HIGH 8.8 CVE-2020-28339 The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not … Welcart E Commerce 1.9.36+ Fix from $1,9502020-11-07 MEDIUM 6.5 CVE-2016-4828 The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging kno… Welcart E Commerce 1.8.3+ Fix from $1,6002016-06-25 MEDIUM 6.1 CVE-2016-4827 Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitra… Welcart E Commerce 1.8.3+ Fix from $1,6002016-06-25 MEDIUM 6.1 CVE-2016-4826 Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitra… Welcart E Commerce 1.8.3+ Fix from $1,6002016-06-25 MEDIUM 5.6 CVE-2016-4825 The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary… Welcart E Commerce 1.8.3+ Fix from $1,6002016-06-25