Welcart e-Commerce

Welcart e-Commerce has 55 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; 54 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 23 high. 2023 was the busiest year with 11 disclosures.

The most common weakness is Cross-Site Scripting, behind 18 of the records (33%). Other recurring categories include SQL Injection, Deserialization Of Untrusted Data.

54 of the records (98%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2014.

35 independent researchers contributed these findings, most of them (4) reported by Gen Sato. Welcart e-Commerce is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage98%

Open

Fixed

Get automatic notifications for all Welcart e-Commerce vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2014-10016

Welcart e-Commerce <= 1.3.12 - Cross-Site Scripting

Read the full analysis

Vulnerability Records

55 records


2026-09-04 17:58	Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback Welcart e-Commerce <= 2.12.1	`CVE-2026-19887`	8.8 High	daroo	Yes
2026-08-31 20:54	Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter Welcart e-Commerce <= 2.12.1	`CVE-2026-19914`	7.2 High	Afifudin Maarif	Yes
2026-08-19 00:00	Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation Welcart e-Commerce < 2.12.1	`CVE-2025-15671`	6.5 Medium	Maktoum (bRpsd)	Yes
2026-08-14 00:00	Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass Welcart e-Commerce < 2.11.33	`CVE-2026-15213`	5.3 Medium	Pedro Pinho	Yes
2026-08-11 00:00	Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting Welcart e-Commerce <= 2.11.31	`CVE-2026-27539`	7.2 High	K. Sorrachat	Yes
2026-08-10 00:00	Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting Welcart e-Commerce <= 2.11.33	`CVE-2026-16066`	6.4 Medium	Yaswanth Reddy Sunkara	Yes
2026-07-31 00:00	Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection Welcart e-Commerce <= 2.11.31	`CVE-2026-16065`	4.9 Medium	Yaswanth Reddy Sunkara	Yes
2026-06-04 00:00	Welcart e-Commerce <= 2.11.28 - Missing Authorization Welcart e-Commerce <= 2.11.28	`CVE-2026-49775`	5.3 Medium	dodoh4t	Yes
2025-11-12 00:00	Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure Welcart e-Commerce <= 2.11.24	`CVE-2025-12979`	5.3 Medium	Marcin Dudek (dudekmar)	Yes
2025-10-21 17:22	Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail Welcart e-Commerce <= 2.11.22	`CVE-2025-10651`	5.5 Medium	Miguel Santareno	Yes

Showing 1–10 of 55 reports

Latestv2.12.3

Welcart e-Commerce

Author

info@welcart

4.5(6)

90/100

Last Updated

2026-09-11 (2d ago)

Active Installs

10,000+

Downloads

1,347,027

Requires WP

5.6+

Requires PHP

7.4+

Tested up to

WP 7.1

Created

2009-10-23 (17y ago)

Welcart is a free WordPress e-commerce plugin with the top market share in Japan. It offers extensive features and flexibility to help you build your own online store with ease. Compatible with PHP 7.4 to 8.3. SHOPPING CART SYSTEM Sell physical products with no limits on the number of items or categories. Manage inventory with SKU codes and configure flexible pricing and shipping options. Additional extension plugins are available to support digital content sales and subscriptions. Over 16 payment services can be added through the official Welcart website. Welcart Payment services (Japanese) DESIGN A free responsive theme (Welcart Basic) is available, along with premium themes. You can customize the design and layout however you like. Welcart Theme downloads (Japanese) MANAGING SYSTEM Order data is automatically saved and updated in the database. The order list page offers powerful filtering by customer information, date, product type, and more. From the order editing page, you can modify order details, send confirmation emails, download receipt PDFs, and more. MEMBERSHIP SYSTEM Welcart includes a built-in membership system with no additional plugins required. The member list page supports searching by customer information and purchase history. A point system is also available for members.

View on WordPress.org