CVE-2026-111031

The Welcart e-Commerce WordPress plugin, in versions prior to 2.12.6 , is vulnerable to an unauthenticated open redirect . The flaw exists because the software fails to properly validate a user-supplied URL before utilizing it for a redirect, specifically via the 'usces_referer' parameter. This a...

CVE-2026-111031 Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites...

CVE-2015-2973

Multiple cross-site scripting XSS vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the uscesreferer parameter to 1 classes/usceshop.class.php, 2 includes/edit-form-advanced.php, 3 includes/edit-form-advanced30.php,...

CVE-2015-2973

Multiple cross-site scripting XSS vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the uscesreferer parameter to 1 classes/usceshop.class.php, 2 includes/edit-form-advanced.php, 3 includes/edit-form-advanced30.php,...

CVE-2015-2973: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the uscesreferer parameter to 1 classes/usceshop.class.php, 2 includes/edit-form-advanced.php, 3 includes/edit-form-advanced30.php,...

JVN#97971874: Welcart vulnerable to cross-site scripting

Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a cross-site scripting CWE-79 vulnerability due to the processing of uscesreferer parameter in admin.php. Impact If a user views a malicious page while logged into WordPress with this plugin...

WordPress Welcart Plugin <= 1.4.17 - Multiple XSS

These vulnerabilities allow the attackers to inject arbitrary web script or HTML via the "uscesreferer" parameter to: includes/edit-form-advanced.php, includes/edit-form-advanced34.php, classes/usceshop.class.php, includes/membereditform.php, includes/orderlist.php, includes/ordereditform.php,...