Known Vulnerabilities for E-Commerce Plugin by Welcart
Listed below are 10 of the newest known vulnerabilities associated with "E-Commerce Plugin" by "Welcart".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-120597 json | A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN:... | Not Provided | 2026-11-02 | 2026-11-03 |
| CVE-2026-119166 json | The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl... | Not Provided | 2026-10-31 | 2026-11-03 |
| CVE-2026-118070 json | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versi... | Not Provided | 2026-10-31 | 2026-11-01 |
| CVE-2026-111032 json | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product bef... | Not Provided | 2026-10-28 | 2026-10-28 |
| CVE-2026-111031 json | The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, al... | Not Provided | 2026-10-28 | 2026-10-28 |
| CVE-2026-111027 json | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a ... | Not Provided | 2026-10-28 | 2026-10-28 |
| CVE-2026-109926 json | The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and ex... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-107752 json | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields s... | Not Provided | 2026-10-17 | 2026-10-18 |
| CVE-2026-103311 json | The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of inco... | Not Provided | 2026-10-19 | 2026-10-19 |
| CVE-2026-92995 json | The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, al... | Not Provided | 2026-09-27 | 2026-09-28 |