Friendly Functions for Welcart

Friendly Functions for Welcart has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (100%).

Every one of the 2 issues recorded for Friendly Functions for Welcart has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Friendly Functions for Welcart is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
5.2/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Friendly Functions for Welcart vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.1CVE-2024-10726

Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Friendly Functions for Welcart banner
Latestv1.2.7

Friendly Functions for Welcart

mainichiweb

Author

mainichiweb

3.7(3)
74/100
Last Updated
2026-04-04 (5mo ago)
Active Installs
1,000+
Downloads
11,681
Requires WP
5.0+
Requires PHP
7.2+
Tested up to
WP 6.9.7
Created
2021-04-27 (6y ago)

“Friendly Functions for Welcart” allows you to easily customize the functions of Welcart. It’s a plugin with a few little features that may help you solve your problems. [Function List] ■ Coupon Discount ■ Shipping Discount ■ Purchase discount ■ Conversion tag installation ■ “Changed the text of the “Cart Button ■ Changed the image of “Business Pack” ■ Change “Continue Shopping” link ■ Change transition page after login ■ Change transition page after logout ■ Change the sender of the order email to the purchaser’s address ■ Deletion of “Membership Number” from order email ■ Display images on estimates, delivery slips, receipts, and invoices ■ Remove OGP property output by Welcart ■ Displayed the number and amount of orders for 12 months ■ Stopped using the cart button temporarily ■ Change the number of products displayed in the admin panel ■ Send out-of-stock alerts ■ Add a search bar to the category selection on the product edit page ■ Show the amount up to the shipping discount ■ Show the amount up to free shipping ■ Show/hide “Furigana”(Japan only) ■ Show/hide “FAX Number” ■ Show/hide “discount amount” on cart page ■ Changed cart button quantity input to “number ■ Change cart page quantity entry to “number” ■ Changed custom field input type to “date ■ Check before transitioning to the input form ■ Show order number and order date ■ Expanded search results ■ Inline output of Welcart’s CSS files Arbitrary section 1

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C