Plugin security history

Welcart e-Commerce Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 48 vulnerability records associated with Welcart e-Commerce, published between 2012 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

48Total records

3Critical

20High

25Medium

0Low

0Informational

47Patched records

1Currently marked unpatched

2012-12-14First disclosure

2026-06-04Latest disclosure

43 of 48CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2012	2	2 records
2014	2	2 records
2015	2	2 records
2016	4	4 records
2020	1	1 records
2021	4	4 records
2022	9	9 records
2023	11	11 records
2024	2	2 records
2025	10	10 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
Critical	3	6.3%
High	20	41.7%
Medium	25	52.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

15 records31.3%

First: 2012. Latest: 2025.

SQL Injection

8 records16.7%

First: 2014. Latest: 2025.

Missing Authorization

7 records14.6%

First: 2021. Latest: 2026.

Other

5 records10.4%

First: 2016. Latest: 2025.

CSRF

4 records8.3%

First: 2012. Latest: 2023.

Information Disclosure

4 records8.3%

First: 2022. Latest: 2022.

Arbitrary File Upload

2 records4.2%

First: 2023. Latest: 2023.

Path Traversal

2 records4.2%

First: 2023. Latest: 2025.

Authentication Bypass

1 record2.1%

First: 2016. Latest: 2016.

Patch Status

Patched: 47
Currently marked unpatched: 1
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.11.29
2.11.25
2.11.23
2.11.22
2.11.21
2.11.17
2.11.14
2.11.10
2.11.2
2.10.0
2.9.4
2.9.7
2.9.6
2.9.5
2.8.22
2.8.11
2.8.9
2.8.6
2.8.5
2.8.4
2.7.8
2.2.8
2.2.4
2.1.1
1.9.36
1.8.3
1.5.3
1.4.18
2.9.2
1.2.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.11.28`	Welcart e-Commerce <= 2.11.28 - Missing Authorization	June 4, 2026	2.11.29	Medium
`*-2.11.24`	Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure	November 12, 2025	2.11.25	Medium
`*-2.11.22`	Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail	October 21, 2025	2.11.23	Medium
`*-2.11.24`	Welcart e-Commerce <= 2.11.24 - Missing Authorization	October 14, 2025	2.11.25	Medium
`*-2.11.21`	Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie	October 7, 2025	2.11.22	Medium
`*-2.11.20`	Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting	September 9, 2025	2.11.21	Medium
`*-2.11.20`	Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting	September 9, 2025	2.11.21	Medium
`*-2.11.16`	Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection	August 12, 2025	2.11.17	Medium
`*-2.11.16`	Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting	July 16, 2025	2.11.17	Medium
`*-2.11.13`	Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion	June 3, 2025	2.11.14	Medium
`*-2.11.9`	Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter	February 11, 2025	2.11.10	High
`*-2.11.1`	Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection	September 18, 2024	2.11.2	Medium
`*-2.9.14`	Welcart e-Commerce <= 2.9.14 - Missing Authorization	April 12, 2024	2.10.0	Medium
`[*, 2.9.4)`	Welcart e-Commerce <= 2.9.3 - Authenticated(Editor+) SQL Injection	December 21, 2023	2.9.4	High
`*-2.9.6`	Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal	December 8, 2023	2.9.7	Medium
`[*, 2.9.6)`	Welcart e-Commerce <= 2.9.5 - Authenticated (Administrator+) PHP Object Injection	November 15, 2023	2.9.6	High
`*-2.9.4`	Welcart e-Commerce <= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload	November 14, 2023	2.9.5	High
`*-2.9.4`	Welcart e-Commerce <= 2.9.4 - Cross-Site Request Forgery	November 14, 2023	2.9.5	High
`*-2.9.4`	Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection	November 10, 2023	2.9.5	Critical
`*-2.9.4`	Welcart e-Commerce <= 2.9.4 - Reflected Cross-Site Scripting	November 10, 2023	2.9.5	Medium
`*-2.8.21`	Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload	September 26, 2023	2.8.22	High
`[*, 2.8.22)`	Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection	September 14, 2023	2.8.22	High
`[*, 2.8.22)`	Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs	September 14, 2023	2.8.22	High
`*-2.8.10`	Welcart e-Commerce <= 2.8.10 - Unauthenticated Stored Cross-Site Scripting	January 27, 2023	2.8.11	High
`*-2.8.8`	Welcart e-Commerce <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	December 23, 2022	2.8.9	Medium

Selected source records

Latest Records

MediumCVE-2026-49775

Welcart e-Commerce <= 2.11.28 - Missing Authorization

Published: June 4, 2026

Affected versions: *-2.11.28
Patched versions: 2.11.29

Original Wordfence record

MediumCVE-2025-12979

Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure

Published: November 12, 2025

Affected versions: *-2.11.24
Patched versions: 2.11.25

Original Wordfence record

MediumCVE-2025-10651

Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail

Published: October 21, 2025

Affected versions: *-2.11.22
Patched versions: 2.11.23

Original Wordfence record

MediumCVE-2025-62953

Welcart e-Commerce <= 2.11.24 - Missing Authorization

Published: October 14, 2025

Affected versions: *-2.11.24
Patched versions: 2.11.25

Original Wordfence record

MediumCVE-2025-10649

Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie

Published: October 7, 2025

Affected versions: *-2.11.21
Patched versions: 2.11.22

Original Wordfence record

MediumCVE-2025-9367

Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting

Published: September 9, 2025

Affected versions: *-2.11.20
Patched versions: 2.11.21

Original Wordfence record

MediumCVE-2025-58984

Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting

Published: September 9, 2025

Affected versions: *-2.11.20
Patched versions: 2.11.21

Original Wordfence record

MediumCVE-2025-54012

Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection

Published: August 12, 2025

Affected versions: *-2.11.16
Patched versions: 2.11.17

Original Wordfence record

Highest-Severity Records

CriticalCVE-2014-10017

Welcart e-Commerce <= 2.9.1 - SQL Injection

Published: March 4, 2014

Affected versions: *-2.9.1
Patched versions: 2.9.2

Original Wordfence record

CriticalCVE-2023-5952

Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection

Published: November 10, 2023

Affected versions: *-2.9.4
Patched versions: 2.9.5

Original Wordfence record

CriticalCVE-2016-4828

Welcart e-Commerce <= 1.8.2 - Authentication Bypass

Published: June 24, 2016

Affected versions: *-1.8.2
Patched versions: 1.8.3

Original Wordfence record

HighCVE-2012-5178

Welcart e-Commerce < 1.2.2 - Cross-Site Request Forgery

Published: December 14, 2012

Affected versions: [*, 1.2.2)
Patched versions: 1.2.2

Original Wordfence record

HighCVE-2023-43493

Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs

Published: September 14, 2023

Affected versions: [*, 2.8.22)
Patched versions: 2.8.22

Original Wordfence record

High

Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery

Published: November 28, 2022

Affected versions: *-2.8.3
Patched versions: 2.8.4

Original Wordfence record

HighCVE-2023-43610

Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection

Published: September 14, 2023

Affected versions: [*, 2.8.22)
Patched versions: 2.8.22

Original Wordfence record

HighCVE-2015-7791

Welcart e-Commerce < 1.5.3 - SQL Injection

Published: December 17, 2015

Affected versions: [*, 1.5.3)
Patched versions: 1.5.3

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2014-10016

Welcart e-Commerce <= 1.3.12 - Cross-Site Scripting

Published: March 3, 2014

Affected versions: *-1.3.12
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory