WordPress Welcart e-Commerce plugin < 2.11.32 - Editor+ SQL Injection via CSV Import vulnerability

Editor+ SQL Injection via CSV Import vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Welcart e-Commerce versions 2.11.32...

PT-2026-79297

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.12.1 Description This issue occurs because the software fails to regenerate the session identifier during authentication and accepts a session identifier provided via a user-supplied request parameter. Th...

WordPress Welcart e-Commerce plugin < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability

Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability discovered by Pedro Pinho in WordPress Plugin Welcart e-Commerce versions 2.11.33...

WordPress Welcart e-Commerce plugin < 2.11.34 - Author+ Stored XSS via Product Name vulnerability

Author+ Stored XSS via Product Name vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Welcart e-Commerce versions 2.11.34...

CVE-2026-27539

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

EUVD-2026-57937

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27539

CVE-2026-27539 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Welcart e-Commerce plugin, versions

CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27539: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

PT-2026-71502

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-15213

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-15213 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-15213

The CVE concerns the Welcart e-Commerce WordPress plugin prior to 2.11.33. The vulnerability lies in the settlement callback for convenience-store/bank-transfer payments, where there is no authenticity verification. An unauthenticated request can flip an order from unpaid to settled using only an...

CVE-2026-16066 Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-16066

The Welcart e-Commerce WordPress plugin, in versions prior to 2.11.34 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise or escape a product field before it is rendered on product pages. This allows users with the Author role or higher ...

CVE-2026-16066

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

EUVD-2026-57086

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-15213: Undefined Security Weakness

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-16066: Improper Neutralization of Input During Web Page Generation

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...