Welcart e-Commerce

Welcart e-Commerce has 58 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; all 58 are fixed as of October 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 25 high. 2026 was the busiest year with 11 disclosures.

The most common weakness is Cross-Site Scripting, behind 20 of the records (34%). Other recurring categories include SQL Injection, Deserialization Of Untrusted Data.

Every one of the 58 issues recorded for Welcart e-Commerce has a vendor fix available, so running the current release closes all known holes.

38 independent researchers contributed these findings, most of them (4) reported by Gen Sato. Welcart e-Commerce is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Welcart e-Commerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2023-5952

Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

58 records


2026-10-16 14:35	Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie Welcart e-Commerce <= 2.12.4	`CVE-2026-107752`	4.9 Medium	Wordfence PRISM	Yes
2026-10-03 00:00	Welcart e-Commerce <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting Welcart e-Commerce <= 2.12.3	`CVE-2026-96761`	7.2 High	Nguyen Ba Khanh	Yes
2026-10-02 17:10	Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters Welcart e-Commerce <= 2.12.2	`CVE-2026-87091`	7.2 High	minhgalaxy	Yes
2026-09-04 17:58	Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback Welcart e-Commerce <= 2.12.1	`CVE-2026-19887`	8.8 High	daroo	Yes
2026-08-31 20:54	Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter Welcart e-Commerce <= 2.12.1	`CVE-2026-19914`	7.2 High	Afifudin Maarif	Yes
2026-08-19 00:00	Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation Welcart e-Commerce < 2.12.1	`CVE-2025-15671`	6.5 Medium	Maktoum (bRpsd)	Yes
2026-08-14 00:00	Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass Welcart e-Commerce < 2.11.33	`CVE-2026-15213`	5.3 Medium	Pedro Pinho	Yes
2026-08-11 00:00	Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting Welcart e-Commerce <= 2.11.31	`CVE-2026-27539`	7.2 High	K. Sorrachat	Yes
2026-08-10 00:00	Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting Welcart e-Commerce <= 2.11.33	`CVE-2026-16066`	6.4 Medium	Yaswanth Reddy Sunkara	Yes
2026-07-31 00:00	Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection Welcart e-Commerce <= 2.11.31	`CVE-2026-16065`	4.9 Medium	Yaswanth Reddy Sunkara	Yes

Showing 1–10 of 58 reports

Latestv2.12.6

Welcart e-Commerce

Author

info@welcart

4.5(6)

90/100

Last Updated

2026-10-23 (5d ago)

Active Installs

10,000+

Downloads

1,376,632

Requires WP

5.6+

Requires PHP

7.4+

Tested up to

WP 7.1.3

Created

2009-10-23 (17y ago)

Welcart is a free WordPress e-commerce plugin with the top market share in Japan. It offers extensive features and flexibility to help you build your own online store with ease. Compatible with PHP 7.4 to 8.3. SHOPPING CART SYSTEM Sell physical products with no limits on the number of items or categories. Manage inventory with SKU codes and configure flexible pricing and shipping options. Additional extension plugins are available to support digital content sales and subscriptions. Over 16 payment services can be added through the official Welcart website. Welcart Payment services (Japanese) DESIGN A free responsive theme (Welcart Basic) is available, along with premium themes. You can customize the design and layout however you like. Welcart Theme downloads (Japanese) MANAGING SYSTEM Order data is automatically saved and updated in the database. The order list page offers powerful filtering by customer information, date, product type, and more. From the order editing page, you can modify order details, send confirmation emails, download receipt PDFs, and more. MEMBERSHIP SYSTEM Welcart includes a built-in membership system with no additional plugins required. The member list page supports searching by customer information and purchase history. A point system is also available for members.

View on WordPress.org