Welcart

Welcart E-commerce

37 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2021-4355

Exploit
  • EPSS 0.81%
  • Veröffentlicht 07.06.2023 02:15:13
  • Zuletzt bearbeitet 08.04.2026 18:17:15

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up...

6.1

CVE-2023-22705

  • EPSS 0.43%
  • Veröffentlicht 29.03.2023 20:15:07
  • Zuletzt bearbeitet 20.02.2025 18:34:50

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions.

5.4

CVE-2022-4655

Exploit
  • EPSS 0.47%
  • Veröffentlicht 16.01.2023 16:15:13
  • Zuletzt bearbeitet 20.02.2025 18:34:50

The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.

8.8

CVE-2022-4237

Exploit
  • EPSS 1.07%
  • Veröffentlicht 02.01.2023 22:15:16
  • Zuletzt bearbeitet 10.04.2025 19:15:51

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to per...

6.5

CVE-2022-4236

Exploit
  • EPSS 0.8%
  • Veröffentlicht 02.01.2023 22:15:16
  • Zuletzt bearbeitet 10.04.2025 19:15:51

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to rea...

7.5

CVE-2022-4140

Exploit
  • EPSS 2.94%
  • Veröffentlicht 02.01.2023 22:15:16
  • Zuletzt bearbeitet 10.04.2025 19:15:51

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server

5.4

CVE-2022-3935

Exploit
  • EPSS 0.47%
  • Veröffentlicht 12.12.2022 18:15:12
  • Zuletzt bearbeitet 22.04.2025 15:16:01

The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks

6.5

CVE-2022-3946

Exploit
  • EPSS 0.33%
  • Veröffentlicht 12.12.2022 18:15:12
  • Zuletzt bearbeitet 22.04.2025 20:15:25

The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.

9.8

CVE-2022-41840

  • EPSS 5.12%
  • Veröffentlicht 18.11.2022 19:15:30
  • Zuletzt bearbeitet 20.02.2025 18:34:50

Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.

6.1

CVE-2021-20734

  • EPSS 1.04%
  • Veröffentlicht 22.06.2021 02:15:07
  • Zuletzt bearbeitet 20.02.2025 18:32:30

Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors.