CVE-2025-27130

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product...

CVE-2025-31543

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Based XSS.This issue affects Twice Commerce: from n/a through = 1.3.1...

CVE-2025-27130

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product...

CVE-2025-27130

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product...

CVE-2025-27130

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product...

CVE-2025-27130

Welcart e-Commerce is a WordPress plugin. The CVE-2025-27130 entry concerns an untrusted data deserialization vulnerability in Welcart e-Commerce versions 2.11.6 and earlier, enabling a remote unauthenticated attacker to execute arbitrary code on websites using the product. The root cause is tied...

CVE-2025-27130

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product...

WordPress plugin "Welcart e-Commerce" vulnerable to untrusted data deserialization

Overview WordPress plugin "Welcart e-Commerce" provided by Welcart Inc. contains an untrusted data deserialization vulnerability CWE-502. Hiroshi Sawada of CrowdStrike Holdings, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

PT-2025-14090 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.11.6 and earlier Description: The issue concerns an untrusted data deserialization vulnerability. If exploited, this could allow a remote unauthenticated attacker to execute arbitrary code and access websites...

Welcart E-Commerce Code Issues and Vulnerabilities

Welcart e-Commerce is a free e-commerce plugin for WordPress from Welcart Japan. A code issue vulnerability exists in Welcart e-Commerce version 2.11.6 and earlier, which stems from untrustworthy data deserialization and could lead to the execution of arbitrary code by a remote, unauthenticated...

CVE-2025-27130: Deserialization of Untrusted Data

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product...

WordPress Twice Commerce plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Twice Commerce versions = 1.3.1...

CVE-2025-31543

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Based XSS.This issue affects Twice Commerce: from n/a through = 1.3.1...

CVE-2025-31543 WordPress Twice Commerce plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Twice Commerce Twice Commerce allows DOM-Based XSS. This issue affects Twice Commerce: from n/a through 1.3.1...

CVE-2025-31543 WordPress Twice Commerce plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Based XSS.This issue affects Twice Commerce: from n/a through = 1.3.1...

CVE-2025-31543

CVE-2025-31543 is a DOM-based Cross-Site Scripting vulnerability in the WordPress plugin Twice Commerce . The description specifies improper input neutralization during web page generation, enabling DOM-level XSS. Affected software is listed as “Twice Commerce: from n/a through 1.3.1,” indicating...

CVE-2025-31543: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Based XSS.This issue affects Twice Commerce: from n/a through = 1.3.1...

WordPress plugin Twice Commerce: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Twice Commerce A...

PT-2025-13711

Name of the Vulnerable Software and Affected Versions Twice Commerce versions 1.3.1 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based Cross-site Scripting XSS. This means that an attacker could potentially injec...

MAL-2025-2802 Malicious code in web-commerce-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3db0dcb1f890e4ce0fdf79bcdd216d419d1bdcefb1cac333858a78b0d7efa3ca The OpenSSF Package Analysis project identified 'web-commerce-hook' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...