Vulnerabilities

TI-2026-36684 CVE-2026-49775 · GHSA-vh2q-m85w-97h5

WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability

LOW 34

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00191 Published 2026-06-15 No fix listed CWE-862

TI-2025-39101 CVE-2025-62953 · GHSA-2x76-q69m-x8p7

WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability

LOW 22

Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00236 Published 2025-10-27 No fix listed CWE-862

TI-2025-36628 CVE-2025-58984 · GHSA-99gh-pgpq-v3fq

WordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) Vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00177 Published 2025-09-09 No fix listed CWE-79

TI-2025-33857 CVE-2025-54012 · GHSA-hjqj-qjq9-mvgj

WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability

LOW 34

Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00481 Published 2025-08-20 No fix listed CWE-502

TI-2025-33858 CVE-2025-54013 · GHSA-7r5g-766r-x96m

WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability