Welcart is a focused WordPress-based e-commerce plugin that, despite a narrow product scope, serves as a transaction and customer-data handling layer for a distributed base of web merchants. The vendor's vulnerability profile is anchored in application-layer input handling and access control, with recurring disclosures spanning cross-site scripting, SQL injection, missing authorization, path traversal, and cross-site request forgery—weakness classes endemic to web applications that process user input and manage administrative boundaries. A meaningful share of the vendor's vulnerabilities reach serious severity, reflecting the direct exposure of these flaws to both attackers and customer data within deployed storefronts. Defenders should treat updates to this plugin as moderate-priority, especially in multi-tenant WordPress hosting environments where a single vulnerable instance may affect many merchants; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Welcart over time
Signals from CVEs in this vendor scope (40 CVEs).
40 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-41840CRITICAL Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. | Nov 18, 2022 | 9.8 | 44 | NO | YES |
CVE-2022-4140HIGH The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to rea | Jan 2, 2023 | 7.5 | 36 | NO | YES |
CVE-2022-4237HIGH The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated | Jan 2, 2023 | 8.8 | 28 | NO | NO |
CVE-2020-28339HIGH The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain. | Nov 7, 2020 | 8.8 | 28 | NO | NO |
CVE-2023-5952CRITICAL The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable g | Dec 4, 2023 | 9.8 | 26 | NO | NO |
CVE-2023-43610HIGH SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perfor | Sep 27, 2023 | 8.8 | 26 | NO | NO |
CVE-2025-27130HIGH Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a rem | Apr 1, 2025 | 8.8 | 24 | NO | NO |
CVE-2023-5953HIGH The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. | Dec 4, 2023 | 8.8 | 24 | NO | NO |
CVE-2024-42404HIGH SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database. | Sep 18, 2024 | 8.8 | 23 | NO | NO |
CVE-2022-4236MEDIUM The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated | Jan 2, 2023 | 6.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (40 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Welcart.
Media articles that mention a CVE ID that affects a product developed by Welcart — matched by CVE ID, not by vendor name.