Welcart E Commerce
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:welcart_e-commerce:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Welcart E Commerce (66221fcf-789f-5a95-b99e-684c8689692a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111032 |
vulnerable | 2026-11-03 10:16:11.346496 |
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
Published: 2026-10-28T06:00:24.660Z
Updated: 2026-10-28T17:58:06.341Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111027 |
vulnerable | 2026-11-03 10:16:11.096817 |
Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.
Published: 2026-10-28T06:00:24.314Z
Updated: 2026-10-28T17:58:06.628Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111031 |
vulnerable | 2026-11-03 10:16:10.917544 |
Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.
Published: 2026-10-28T06:00:24.488Z
Updated: 2026-10-28T17:58:06.485Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15213 |
vulnerable | 2026-09-16 04:33:06.548403 |
Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback
MEDIUM (5.3)
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
Published: 2026-08-12T11:23:58.523Z
Updated: 2026-08-12T12:15:36.791Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16065 |
vulnerable | 2026-09-16 04:32:56.845111 |
Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.
Published: 2026-08-06T06:00:11.567Z
Updated: 2026-08-06T12:40:57.571Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16066 |
vulnerable | 2026-09-16 04:32:56.495340 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5953 |
vulnerable | 2026-06-08 06:19:45.198122 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5952 |
vulnerable | 2026-06-08 06:19:45.197664 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5951 |
vulnerable | 2026-06-08 06:19:45.195953 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4655 |
vulnerable | 2026-06-08 05:52:00.119652 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4237 |
vulnerable | 2026-06-08 05:51:37.024186 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4236 |
vulnerable | 2026-06-08 05:51:37.023679 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4140 |
vulnerable | 2026-06-08 05:51:36.860705 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3946 |
vulnerable | 2026-06-08 05:48:22.682984 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3935 |
vulnerable | 2026-06-08 05:48:22.659372 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.