Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Welcart e-Commerce — Vulnerabilities & Security Advisories 45

All 45 CVE vulnerabilities found in Welcart e-Commerce, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting the Welcart e-Commerce product. It collects various weakness types, including SQL injection, cross-site scripting, and path traversal, covering advisories published over the recent years. You can use this section to track vendor security advisories, understand the impact of specific weakness classes, and review the complete vulnerability history for this product. The data provides a structured view of how vulnerabilities evolve across different versions, enabling users to identify recurring patterns and assess remediation needs. No specific CVE identifiers are listed here; instead, the focus is on categorizing issues by type and timeframe. This aggregation helps developers and security teams monitor the security posture of the Welcart e-Commerce platform and prioritize fixes based on severity and frequency of occurrences.

Vendor: Collne Inc.

CVE ID Title CVSS Severity Published
CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback CWE-502 8.8 High 2026-09-05
CVE-2026-19914 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter CWE-79 7.2 High 2026-09-01
CVE-2025-15671 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter - - 2026-08-21
CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-08-13
CVE-2026-15213 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback 5.3 Medium 2026-08-12
CVE-2026-16066 Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name - - 2026-08-12
CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import - - 2026-08-06
CVE-2026-49775 WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability CWE-862 6.5 Medium 2026-06-15
CVE-2025-12979 Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure CWE-862 5.3 Medium 2025-11-13
CVE-2025-62953 WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability CWE-862 4.3 Medium 2025-10-27
CVE-2025-10651 Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail CWE-79 5.5 Medium 2025-10-22
CVE-2025-10649 Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie CWE-89 6.5 Medium 2025-10-08
CVE-2025-9367 Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting CWE-79 5.5 Medium 2025-09-10
CVE-2025-58984 WordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) Vulnerability CWE-79 5.9 Medium 2025-09-09
CVE-2025-54012 WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability CWE-502 7.2 High 2025-08-20
CVE-2025-54013 WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability CWE-79 5.9 Medium 2025-07-16
CVE-2025-47511 WordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability CWE-22 6.8 Medium 2025-06-09
CVE-2025-27130 Welcart e-Commerce 代码问题漏洞 CWE-502 9.8 - 2025-04-01
CVE-2025-0511 Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter CWE-79 7.2 High 2025-02-12
CVE-2024-45366 WordPress plugin Welcart e-Commerce 安全漏洞 6.1AI Medium AI 2024-09-18
CVE-2024-42404 WordPress plugin Welcart e-Commerce 安全漏洞 8.1AI High AI 2024-09-18
CVE-2024-32144 WordPress Welcart e-Commerce plugin <= 2.9.14 - Broken Access Control vulnerability CWE-862 5.4 Medium 2024-06-11
CVE-2023-50847 WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL Injection CWE-89 7.6 High 2023-12-28
CVE-2023-6120 Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal CWE-22 4.1 Medium 2023-12-09
CVE-2023-5951 Welcart e-Commerce < 2.9.5 - Reflected XSS 6.1AI Medium AI 2023-12-04
CVE-2023-5953 Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload 8.8AI High AI 2023-12-04
CVE-2023-5952 Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection 9.8AI Critical AI 2023-12-04
CVE-2023-43614 WordPress Plugin Welcart e-Commerce 跨站脚本漏洞 6.1 - 2023-09-26
CVE-2023-43610 WordPress Plugin Welcart e-Commerce SQL注入漏洞 8.8 - 2023-09-26
CVE-2023-43493 WordPress Plugin Welcart e-Commerce SQL注入漏洞 6.5 - 2023-09-26

All 45 known CVE vulnerabilities affecting Welcart e-Commerce with full Chinese analysis, references, and POCs where available.