Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · usc-e-shop
usc-e-shop (aka Collne Welcart e-Commerce)
43 known vulnerabilities on record. Add your version above to see which ones affect you.
Is usc-e-shop (aka Collne Welcart e-Commerce) safe? The full page →
Oct 28, 2026Welcart e-Commerce: Does not properly verify authorization against the targeted product before processing SKU changesCVE-2026-111032 · fixed in 2.12.6 · reported by WPScanLow 3.8
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
Oct 28, 2026Welcart e-Commerce: Does not validate a user-supplied URL before using it in a redirectCVE-2026-111031 · fixed in 2.12.6 · reported by WPScanMedium 4.7
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.
Oct 28, 2026Welcart e-Commerce: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-111027 · fixed in 2.12.6 · reported by WPScanMedium 6.8
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.
Oct 17, 2026Welcart e-Commerce: Generic SQL InjectionCVE-2026-107752 · affects up to 2.12.4 · reported by WordfenceMedium 4.9
The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96761 · affects up to 2.12.3 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.
Oct 3, 2026Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2026-87091 · affects up to 2.12.2 · reported by WordfenceHigh 7.2
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endpoint accepts the 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification, meaning any unauthenticated attacker can directly submit malicious payloads that are stored and later rendered in the administrator's settlement error log view.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Welcart e-Commerce: PHP Object InjectionCVE-2026-19887 · affects up to 2.12.1 · reported by WordfenceHigh 8.8
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2026-19914 · affects up to 2.12.1 · reported by WordfenceHigh 7.2
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is delivered via the guest checkout form, requiring no authentication, and executes when an administrator views the affected order in the WordPress admin panel.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 21, 2026Welcart e-Commerce: Does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameterCVE-2025-15671 · fixed in 2.12.1 · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.CVE-2026-27539 · affects up to 2.11.31 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
Aug 12, 2026Welcart e-Commerce: Does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a staCVE-2026-15213 · fixed in 2.11.33 · reported by WPScanMedium 5.3
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
Aug 12, 2026Welcart e-Commerce: Does not sanitise or escape a product field before outputting it on the product pagesCVE-2026-16066 · fixed in 2.11.34 · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
Aug 6, 2026Welcart e-Commerce: Does not properly sanitise a value taken from an imported CSV file before using it in a SQL statementCVE-2026-16065 · fixed in 2.11.32 · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.
Jun 15, 2026Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.CVE-2026-49775 · affects up to 2.11.28 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
Nov 12, 2025Welcart e-Commerce: Unauthorized access of dataCVE-2025-12979 · affects up to 2.11.24 · reported by WordfenceMedium 5.3
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials (ex. PayPal api secret) , as well as business contact details, mail templates, and other operational settings tied to the store.
Oct 26, 2025Welcart e-Commerce: Missing AuthorizationCVE-2025-62953 · affects up to 2.11.24 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.
Oct 22, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-10651 · affects up to 2.11.22 · reported by WordfenceMedium 5.5
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22. This is due to insufficient sanitization on the order_mail field and a lack of escaping on output. This makes it possible for authenticated attackers, with Editor-level permissions and above, to inject arbitrary web scripts via the General Setting page that will execute when an administrator accesses the E-mail Setting page.
Oct 8, 2025Welcart e-Commerce: SQL InjectionCVE-2025-10649 · affects up to 2.11.21 · reported by WordfenceMedium 6.5
The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Sep 10, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-9367 · affects up to 2.11.20 · reported by WordfenceMedium 5.5
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Sep 9, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58984 · affects up to 2.11.20 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.20.
Aug 20, 2025Welcart e-Commerce: Deserialization of Untrusted DataCVE-2025-54012 · affects up to 2.11.16 · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.
Jul 16, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54013 · affects up to 2.11.16 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.
Jun 9, 2025Welcart e-Commerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47511 · affects up to 2.11.13 · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.
Feb 12, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-0511 · affects up to 2.11.9 · reported by WordfenceHigh 7.2
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 11, 2024Welcart e-Commerce: Missing AuthorizationCVE-2024-32144 · affects up to 2.9.14 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14.
Dec 28, 2023Welcart e-Commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50847 · affects up to 2.9.3 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.
Dec 9, 2023Welcart e-Commerce: Directory TraversalCVE-2023-6120 · affects up to 2.9.6 · reported by WordfenceMedium 4.1
The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 4, 2023Welcart e-Commerce: Does not validate files to be uploadedCVE-2023-5953 · fixed in 2.9.5 · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server
Dec 4, 2023Welcart e-Commerce: Unserializes user input from cookiesCVE-2023-5952 · fixed in 2.9.5 · reported by WPScanCritical 9.8
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
Dec 4, 2023Welcart e-Commerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5951 · fixed in 2.9.5 · reported by WPScanMedium 6.1
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Jun 6, 2023Welcart e-Commerce: Authorization bypassCVE-2021-4375 · affects up to 2.2.7 · reported by WordfenceMedium 4.3
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information() function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPress settings, plugin settings, PHP settings and server settings.
Jun 6, 2023Welcart e-Commerce: Authorization bypassCVE-2021-4355 · affects up to 2.2.7 · reported by WordfenceHigh 7.5
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.
Mar 29, 2023Collne Inc: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-22705 · affects up to 2.8.10 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions.
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · fixed in 2.8.9 · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · fixed in 2.8.6 · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · fixed in 2.8.5 · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a fileCVE-2022-4140 · fixed in 2.8.5 · reported by WPScanHigh 7.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
Dec 12, 2022Welcart e-Commerce: Does not have authorisation and CSRF in an AJAX actionCVE-2022-3946 · fixed in 2.8.4 · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
Dec 12, 2022Welcart e-Commerce: Does not sanitise and escape some parametersCVE-2022-3935 · fixed in 2.8.4 · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
Nov 18, 2022Unauth.CVE-2022-41840 · affects up to 2.7.7 · reported by PatchstackHigh 7.5
Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.
Nov 7, 2020The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize.CVE-2020-28339 · fixed in 1.9.36 · reported by MITREHigh 7.5
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain.
Jan 13, 2015Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1CVE-2014-10017 · affects 1.3.12 to 1.3.12 · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) changeSort or (2) switch parameter in the usces_itemedit page to wp-admin/admin.php.
Jan 13, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script CVE-2014-10016 · affects 1.3.12 to 1.3.12 · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchase_limit or the (2) name, (3) intl, (4) nocod, or (5) time parameter in an add_delivery_method action to wp-admin/admin-ajax.php.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.