Friendly Functions for Welcart
Friendly Functions for Welcart has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (100%).
Every one of the 2 issues recorded for Friendly Functions for Welcart has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Friendly Functions for Welcart is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2024-10726Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

Friendly Functions for Welcart
Author
mainichiweb
“Friendly Functions for Welcart” allows you to easily customize the functions of Welcart. It’s a plugin with a few little features that may help you solve your problems. [Function List] ■ Coupon Discount ■ Shipping Discount ■ Purchase discount ■ Conversion tag installation ■ “Changed the text of the “Cart Button ■ Changed the image of “Business Pack” ■ Change “Continue Shopping” link ■ Change transition page after login ■ Change transition page after logout ■ Change the sender of the order email to the purchaser’s address ■ Deletion of “Membership Number” from order email ■ Display images on estimates, delivery slips, receipts, and invoices ■ Remove OGP property output by Welcart ■ Displayed the number and amount of orders for 12 months ■ Stopped using the cart button temporarily ■ Change the number of products displayed in the admin panel ■ Send out-of-stock alerts ■ Add a search bar to the category selection on the product edit page ■ Show the amount up to the shipping discount ■ Show the amount up to free shipping ■ Show/hide “Furigana”(Japan only) ■ Show/hide “FAX Number” ■ Show/hide “discount amount” on cart page ■ Changed cart button quantity input to “number ■ Change cart page quantity entry to “number” ■ Changed custom field input type to “date ■ Check before transitioning to the input form ■ Show order number and order date ■ Expanded search results ■ Inline output of Welcart’s CSS files Arbitrary section 1
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C