CVE-2022-4140

CVE-2022-4140 - WordPress plugin Welcart e-Commerce 2.8.5 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2022-4140. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own ...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...

EUVD-2026-71883

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

PT-2026-86327

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.2 Description PHP Object Injection occurs due to the deserialization of untrusted input within the Telecom EDY payment callback usces action acting transaction. Unauthenticated...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability

Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability discovered by daroo in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

CVE-2026-19914

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-19914

Welcart e-Commerce (WordPress plugin) has a Stored Cross-Site Scripting vulnerability via the custom_order parameter , affecting all versions up to and including 2.12.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject arbitrary scripts...

EUVD-2026-68997

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-19914 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'customorder' Parameter vulnerability discovered by Afifudin Maarif in WordPress Plugin Welcart e-Commerce versions = 2.12.1...

CVE-2025-15671

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671

CVE-2025-15671 affects the Welcart e-Commerce WordPress plugin prior to version 2.12.1 . The plugin does not regenerate the session identifier upon authentication and instead sets it from the user-supplied uscesid request parameter. This allows an unauthenticated attacker to fixate a shop member'...

EUVD-2025-210759

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

WordPress Image Uploader for Welcart plugin <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability

Authenticated Author+ SQL Injection via Attachment 'posttitle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Image Uploader for Welcart versions = 1.4.6...

CVE-2026-16080

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-16080 Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-16080

CVE-2026-16080 affects the WordPress plugin “Image Uploader for Welcart” (authenticated scenario). The vulnerability is a generic SQL injection in the attachment field post_title for versions up to 1.4.6, caused by insufficient escaping of user input and lack of proper query preparation. Impact d...