Advisories · Technology

uscnanbu Welcart e-Commerce.

Every CVE that names uscnanbu Welcart e-Commerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-119166 CVE record

CVSS 5.3 Medium

Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
- uscnanbu Welcart e-Commerce
- Authentication bypass
Not analysed yet 31 Oct 2026
CVE-2026-118070 CVE record

CVSS 7.2 High

Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
Not analysed yet 31 Oct 2026
CVE-2026-107752 CVE record

CVSS 4.9 Medium

Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
- uscnanbu Welcart e-Commerce
- SQL injection
Not analysed yet 17 Oct 2026
CVE-2026-87091 CVE record

CVSS 7.2 High

Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
Not analysed yet 3 Oct 2026
CVE-2026-19887 CVE record

CVSS 8.8 High

Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
- uscnanbu Welcart e-Commerce
- Insecure deserialization
Not analysed yet 5 Sept 2026
CVE-2026-19914 CVE record

CVSS 7.2 High

Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
Not analysed yet 1 Sept 2026
CVE-2025-12979 CVE record

CVSS 5.3 Medium

Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure
- uscnanbu Welcart e-Commerce
- Broken access control
Not analysed yet 13 Nov 2025
CVE-2025-10651 CVE record

CVSS 5.5 Medium

Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2025
CVE-2025-10649 CVE record

CVSS 6.5 Medium

Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie
- uscnanbu Welcart e-Commerce
- SQL injection
Not analysed yet 8 Oct 2025
CVE-2025-9367 CVE record

CVSS 5.5 Medium

Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
Not analysed yet 10 Sept 2025
CVE-2025-0511 CVE record

CVSS 7.2 High

Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
Not analysed yet 12 Feb 2025
CVE-2023-6120 CVE record

CVSS 4.1 Medium

Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal
- uscnanbu Welcart e-Commerce
- Path traversal
Not analysed yet 9 Dec 2023
CVE-2021-4375 CVE record

CVSS 4.3 Medium

Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure
- uscnanbu Welcart e-Commerce
- Broken access control
Not analysed yet 7 Jun 2023
CVE-2021-4355 CVE record

CVSS 7.5 High

Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure
- uscnanbu Welcart e-Commerce
- Broken access control
Not analysed yet 7 Jun 2023