# Welcart e-Commerce.

Every CVE that names Welcart e-Commerce among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax](https://agentprime.io/advisories/CVE-2026-111032.md)
  `CVE-2026-111032` · CVE record: Unknown Welcart e-Commerce · CVSS 3.8 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter](https://agentprime.io/advisories/CVE-2026-111031.md)
  `CVE-2026-111031` · CVE record: Unknown Welcart e-Commerce · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Open redirect
- [Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter](https://agentprime.io/advisories/CVE-2026-111027.md)
  `CVE-2026-111027` · CVE record: Unknown Welcart e-Commerce · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96761.md)
  `CVE-2026-96761` · CVE record: Welcart Welcart e-Commerce · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter](https://agentprime.io/advisories/CVE-2025-15671.md)
  `CVE-2025-15671` · CVE record: Unknown Welcart e-Commerce · CVSS 5.4 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Authentication bypass
- [WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-27539.md)
  `CVE-2026-27539` · CVE record: Welcart Welcart e-Commerce · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback](https://agentprime.io/advisories/CVE-2026-15213.md)
  `CVE-2026-15213` · CVE record: Unknown Welcart e-Commerce · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026
- [Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name](https://agentprime.io/advisories/CVE-2026-16066.md)
  `CVE-2026-16066` · CVE record: Unknown Welcart e-Commerce · CVSS 5.4 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import](https://agentprime.io/advisories/CVE-2026-16065.md)
  `CVE-2026-16065` · CVE record: Unknown Welcart e-Commerce · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: SQL injection
- [Welcart e-Commerce < 2.9.5 - Reflected XSS](https://agentprime.io/advisories/CVE-2023-5951.md)
  `CVE-2023-5951` · CVE record: Unknown Welcart e-Commerce · CVSS 6.1 Medium · Not analysed yet · Published 4 Dec 2023
- [Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload](https://agentprime.io/advisories/CVE-2023-5953.md)
  `CVE-2023-5953` · CVE record: Unknown Welcart e-Commerce · CVSS 8.8 High · Not analysed yet · Published 4 Dec 2023
- [Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2023-5952.md)
  `CVE-2023-5952` · CVE record: Unknown Welcart e-Commerce · No CVSS score · Not analysed yet · Published 4 Dec 2023
- [Welcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via Shortcode](https://agentprime.io/advisories/CVE-2022-4655.md)
  `CVE-2022-4655` · CVE record: Unknown Welcart e-Commerce · CVSS 5.4 Medium · Not analysed yet · Published 16 Jan 2023
- [Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation](https://agentprime.io/advisories/CVE-2022-4237.md)
  `CVE-2022-4237` · CVE record: Unknown Welcart e-Commerce · CVSS 8.8 High · Not analysed yet · Published 2 Jan 2023
- [Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access](https://agentprime.io/advisories/CVE-2022-4236.md)
  `CVE-2022-4236` · CVE record: Unknown Welcart e-Commerce · CVSS 6.5 Medium · Not analysed yet · Published 2 Jan 2023
- [Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access](https://agentprime.io/advisories/CVE-2022-4140.md)
  `CVE-2022-4140` · CVE record: Unknown Welcart e-Commerce · CVSS 7.5 High · Not analysed yet · Published 2 Jan 2023
- [Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion](https://agentprime.io/advisories/CVE-2022-3946.md)
  `CVE-2022-3946` · CVE record: Unknown Welcart e-Commerce · CVSS 6.5 Medium · Not analysed yet · Published 12 Dec 2022
- [Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2022-3935.md)
  `CVE-2022-3935` · CVE record: Unknown Welcart e-Commerce · CVSS 5.4 Medium · Not analysed yet · Published 12 Dec 2022

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=welcart-e-commerce>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/welcart-e-commerce/>. Everything for agents: <https://agentprime.io/llms.txt>.