Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Welcart e-Commerce 2.12.6 Clear all filters
TI-2026-81703 CVE-2026-111032 · GHSA-3rmh-w7g6-4jgh

Welcart e-Commerce lets authors change any product's SKU data

Priority LOW 17

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edite…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00194 Published 2026-10-28 Fixed in 2.12.6 CWE-863
TI-2026-81702 CVE-2026-111031 · GHSA-x4hx-935f-mhv9

Welcart e-Commerce Unauthenticated Open Redirect via usces_referer

Priority LOW 21

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.0024 Published 2026-10-28 Fixed in 2.12.6 CWE-601
TI-2026-81701 CVE-2026-111027 · GHSA-r747-x6cp-8vgw

SQL injection in Welcart e-Commerce via log_id parameter

Priority LOW 30

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00297 Published 2026-10-28 Fixed in 2.12.6 CWE-89