Welcart e-Commerce

Explore Welcart e-Commerce vulnerabilities across all versions. Currently tracking 48 known vulnerabilities, including severity, impact, and patch status.

01234567891023.10.2009Today14.12.20128.8Welcart e-Commerce < 1.2.2 - Cross-Site Request Forgery CVSS 8.8 · 14.12.20126.1Welcart e-Commerce < 1.2.2 - Cross-Site Scripting CVSS 6.1 · 14.12.201203.03.20146.1Welcart e-Commerce <= 1.3.12 - Cross-Site Scripting CVSS 6.1 · 03.03.201404.03.20149.8Welcart e-Commerce <= 2.9.1 - SQL Injection CVSS 9.8 · 04.03.201415.07.20157.1Welcart e-Commerce < 1.4.18 - Multiple Cross-Site Scripting CVSS 7.1 · 15.07.201517.12.20158.8Welcart e-Commerce < 1.5.3 - SQL Injection CVSS 8.8 · 17.12.201524.06.20166.1Welcart e-Commerce < 1.8.3 - Reflected Cross-Site Scripting CVSS 6.1 · 24.06.20168.1Welcart e-Commerce < 1.8.3 - Object Injection CVSS 8.1 · 24.06.20169.8Welcart e-Commerce <= 1.8.2 - Authentication Bypass CVSS 9.8 · 24.06.20166.1Welcart e-Commerce <= 1.8.2 - Cross-Site Scripting CVSS 6.1 · 24.06.201605.11.20207.5Welcart e-Commerce <= 1.9.35 - PHP Object Injection CVSS 7.5 · 05.11.202008.02.20218.8Welcart e-Commerce <= 2.1.0 - SQL Injection CVSS 8.8 · 08.02.202111.06.20216.1Welcart e-Commerce <= 2.2.3 - Reflected Cross-Site Scripting CVSS 6.1 · 11.06.202106.08.20214.3Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure CVSS 4.3 · 06.08.20217.5Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure CVSS 7.5 · 06.08.202102.09.20227.5Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read CVSS 7.5 · 02.09.202216.11.20228.8Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery CVSS 8.8 · 16.11.202221.11.20226.4Welcart e-Commerce <= 2.8.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 21.11.20225.4Welcart e-Commerce <= 2.8.3 - Missing Authorization CVSS 5.4 · 21.11.202228.11.20228.8Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery CVSS 8.8 · 28.11.202230.11.20227.5Welcart e-Commerce 2.6.10-2.8.4 - Information Disclosure via Arbitrary File Read CVSS 7.5 · 30.11.202205.12.20226.5Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read CVSS 6.5 · 05.12.20226.5Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization CVSS 6.5 · 05.12.202223.12.20226.4Welcart e-Commerce <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 23.12.202227.01.20237.2Welcart e-Commerce <= 2.8.10 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 27.01.202314.09.20238.8Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs CVSS 8.8 · 14.09.20238.8Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection CVSS 8.8 · 14.09.202326.09.20238.8Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload CVSS 8.8 · 26.09.202310.11.20236.1Welcart e-Commerce <= 2.9.4 - Reflected Cross-Site Scripting CVSS 6.1 · 10.11.20239.8Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection CVSS 9.8 · 10.11.202314.11.20238.8Welcart e-Commerce <= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 8.8 · 14.11.20238.8Welcart e-Commerce <= 2.9.4 - Cross-Site Request Forgery CVSS 8.8 · 14.11.202315.11.20237.2Welcart e-Commerce <= 2.9.5 - Authenticated (Administrator+) PHP Object Injection CVSS 7.2 · 15.11.202308.12.20234.1Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal CVSS 4.1 · 08.12.202321.12.20237.2Welcart e-Commerce <= 2.9.3 - Authenticated(Editor+) SQL Injection CVSS 7.2 · 21.12.202312.04.20245.4Welcart e-Commerce <= 2.9.14 - Missing Authorization CVSS 5.4 · 12.04.202418.09.20244.9Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection CVSS 4.9 · 18.09.202411.02.20257.2Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter CVSS 7.2 · 11.02.202503.06.20256.5Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion CVSS 6.5 · 03.06.202516.07.20255.5Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting CVSS 5.5 · 16.07.202512.08.20256.6Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection CVSS 6.6 · 12.08.202509.09.20254.4Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting CVSS 4.4 · 09.09.20255.5Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting CVSS 5.5 · 09.09.202507.10.20256.5Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie CVSS 6.5 · 07.10.202514.10.20254.3Welcart e-Commerce <= 2.11.24 - Missing Authorization CVSS 4.3 · 14.10.202521.10.20255.5Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail CVSS 5.5 · 21.10.202512.11.20255.3Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure CVSS 5.3 · 12.11.202504.06.20265.3Welcart e-Commerce <= 2.11.28 - Missing Authorization CVSS 5.3 · 04.06.2026

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage98%
Open

1

Fixed

47

Get automatic notifications for all Welcart e-Commerce vulnerabilities before they are exploited.

Vulnerability Records

48 records
2026-06-04 00:00CVE-2026-49775
5.3
Medium
dodoh4tYes
2025-11-12 00:00CVE-2025-12979
5.3
Medium
Marcin Dudek (dudekmar)Yes
2025-10-21 17:22CVE-2025-10651
5.5
Medium
Miguel SantarenoYes
2025-10-14 00:00CVE-2025-62953
4.3
Medium
Legion HunterYes
2025-10-07 00:00CVE-2025-10649
6.5
Medium
Peter ThaleikisYes
2025-09-09 18:30CVE-2025-9367
5.5
Medium
Miguel SantarenoYes
2025-09-09 00:00CVE-2025-58984
4.4
Medium
63n0Yes
2025-08-12 00:00CVE-2025-54012
6.6
Medium
63n0Yes
2025-07-16 00:00CVE-2025-54013
5.5
Medium
Gai Tanaka (63n0)Yes
2025-06-03 00:00CVE-2025-47511
6.5
Medium
Martino SpagnuoloYes
Showing 1–10 of 48 reports
Welcart e-Commerce banner
Latestv2.11.31

Welcart e-Commerce

info@welcart

Author

info@welcart

4.5(6)
90/100
Last Updated
2026-07-02 (28d ago)
Active Installs
10,000+
Downloads
1,305,954
Requires WP
5.6+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2009-10-23 (17y ago)

Welcart is a free WordPress e-commerce plugin with the top market share in Japan. It offers extensive features and flexibility to help you build your own online store with ease. Compatible with PHP 7.4 to 8.3. SHOPPING CART SYSTEM Sell physical products with no limits on the number of items or categories. Manage inventory with SKU codes and configure flexible pricing and shipping options. Additional extension plugins are available to support digital content sales and subscriptions. Over 16 payment services can be added through the official Welcart website. Welcart Payment services (Japanese) DESIGN A free responsive theme (Welcart Basic) is available, along with premium themes. You can customize the design and layout however you like. Welcart Theme downloads (Japanese) MANAGING SYSTEM Order data is automatically saved and updated in the database. The order list page offers powerful filtering by customer information, date, product type, and more. From the order editing page, you can modify order details, send confirmation emails, download receipt PDFs, and more. MEMBERSHIP SYSTEM Welcart includes a built-in membership system with no additional plugins required. The member list page supports searching by customer information and purchase history. A point system is also available for members.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C