Welcart E Commerce

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.

Published: 2026-08-12T11:23:58.523Z
Updated: 2026-08-12T12:15:36.791Z

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.

Published: 2026-08-06T06:00:11.567Z
Updated: 2026-08-06T12:40:57.571Z

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

Published: 2026-08-12T06:00:14.817Z
Updated: 2026-08-12T16:09:32.179Z

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server

Published: 2023-12-04T21:28:03.020Z
Updated: 2025-05-29T13:53:03.148Z

The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog

Published: 2023-12-04T21:27:54.563Z
Updated: 2024-08-02T08:14:25.117Z