# Welcart e-Commerce

> Welcart is a free WordPress e-commerce plugin with the top market share in Japan.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:27 UTC.

## Facts (WordPress.org)

- Slug: `usc-e-shop`
- Author: info@welcart
- Version: 2.11.37
- Active installs: 10,000+
- Last update: 2026-11-12 (2 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.6, PHP 7.4
- Tags: cart, e-commerce, shopping, store, Welcart
- Page: https://wordpress.org/plugins/usc-e-shop/

## Checks (against WordPress 7.1.4)

- OK: Updated 2 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Slow ↔ Responsive, Paywalled ↔ Generous, Cluttered ↔ Clean, Locked in ↔ Portable, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-09 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 2.12.6) **latest version still affected, no fix yet**. CVE-2026-119505, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3322f0-6cff-4508-83c7-291608672707?source=api-prod
- 2026-10-31 HIGH: Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter (up to 2.12.5) **latest version still affected, no fix yet**. CVE-2026-118070, https://www.wordfence.com/threat-intel/vulnerabilities/id/97e73872-bd1a-4b3a-9021-d0cd648456eb?source=api-prod
- 2026-10-31 MEDIUM: Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter (up to 2.12.5) **latest version still affected, no fix yet**. CVE-2026-119166, https://www.wordfence.com/threat-intel/vulnerabilities/id/e93b0ebf-576d-48d0-95f7-87135f45980f?source=api-prod
- 2026-10-28 MEDIUM: Authenticated (Editor+) SQL Injection (before 2.12.6) **latest version still affected, no fix yet**. CVE-2026-111027, https://www.wordfence.com/threat-intel/vulnerabilities/id/618838c1-4fdf-4cf2-b00d-82b50e595692?source=api-prod
- 2026-10-28 MEDIUM: Unauthenticated Open Redirect (before 2.12.6) **latest version still affected, no fix yet**. CVE-2026-111031, https://www.wordfence.com/threat-intel/vulnerabilities/id/251d4eb6-d87d-4d1e-9dac-30f24b4e65ef?source=api-prod
- 2026-10-28 MEDIUM: Missing Authorization (before 2.12.6) **latest version still affected, no fix yet**. CVE-2026-111032, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed505037-b91c-42af-9316-1eed341ebef8?source=api-prod
- 2026-10-17 MEDIUM: Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie (up to 2.12.4) **latest version still affected, no fix yet**. CVE-2026-107752, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e78b5db-3f38-4ed7-9bec-6dd55d44f04f?source=api-prod
- 2026-10-09 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 2.12.3) **latest version still affected, no fix yet**. CVE-2026-96761, https://www.wordfence.com/threat-intel/vulnerabilities/id/6573ebcd-5cf6-4d40-8768-911304744d11?source=api-prod
- 2026-10-03 HIGH: Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters (up to 2.12.2) **latest version still affected, no fix yet**. CVE-2026-87091, https://www.wordfence.com/threat-intel/vulnerabilities/id/d6046c06-9a77-450f-9cdf-c5239e73cb6b?source=api-prod
- 2026-09-05 HIGH: Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback (up to 2.12.1) **latest version still affected, no fix yet**. CVE-2026-19887, https://www.wordfence.com/threat-intel/vulnerabilities/id/716a7c3c-2e26-4da9-a299-7dcbaa7e4895?source=api-prod
- 2026-09-01 HIGH: Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter (up to 2.12.1) **latest version still affected, no fix yet**. CVE-2026-19914, https://www.wordfence.com/threat-intel/vulnerabilities/id/527630bf-d034-4fcd-8fbe-01b388701049?source=api-prod
- 2026-08-21 MEDIUM: Unauthenticated Session Fixation (before 2.12.1) **latest version still affected, no fix yet**. CVE-2025-15671, https://www.wordfence.com/threat-intel/vulnerabilities/id/09a16956-5dab-4ef1-9037-fdd28bcc2e26?source=api-prod
- 2026-08-13 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 2.11.31). CVE-2026-27539, https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed23152-30bd-40ab-947b-f773eb2a6b4f?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 2.11.33). CVE-2026-16066, https://www.wordfence.com/threat-intel/vulnerabilities/id/6b2f6506-1a45-4967-9972-283505df25af?source=api-prod
- 2026-08-12 MEDIUM: Unauthenticated Payment Bypass (before 2.11.33). CVE-2026-15213, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9d3588-9c71-485a-9183-3d1d4a936e03?source=api-prod
- 2026-08-06 MEDIUM: Authenticated (Editor+) SQL Injection (up to 2.11.31). CVE-2026-16065, https://www.wordfence.com/threat-intel/vulnerabilities/id/2be23829-cbee-4e44-945d-14835dbba104?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 2.11.28). CVE-2026-49775, https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1391b1-b0c3-4cf4-8850-d9367d90ec9e?source=api-prod
- 2025-11-12 MEDIUM: Missing Authorization to Unauthenticated Information Exposure (up to 2.11.24). CVE-2025-12979, https://www.wordfence.com/threat-intel/vulnerabilities/id/26255cd9-2361-4d17-8d1b-9bdadcc69043?source=api-prod
- 2025-10-21 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting via order_mail (up to 2.11.22). CVE-2025-10651, https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1f81e8-64ed-4330-9c76-1a8d2e2d307d?source=api-prod
- 2025-10-14 MEDIUM: Missing Authorization (up to 2.11.24). CVE-2025-62953, https://www.wordfence.com/threat-intel/vulnerabilities/id/fe29d7bf-3cf8-429c-91d7-2a8038749c42?source=api-prod
- 2025-10-07 MEDIUM: Authenticated (Author+) SQL Injection via Cookie (up to 2.11.21). CVE-2025-10649, https://www.wordfence.com/threat-intel/vulnerabilities/id/4d59eedb-550f-44c1-a0cd-609c5661134d?source=api-prod
- 2025-09-09 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting (up to 2.11.20). CVE-2025-9367, https://www.wordfence.com/threat-intel/vulnerabilities/id/829facc1-443d-481f-b23f-7a93938dd866?source=api-prod
- 2025-09-09 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting (up to 2.11.20). CVE-2025-58984, https://www.wordfence.com/threat-intel/vulnerabilities/id/e5343bc9-5dcd-410b-a7b7-27734910ad3c?source=api-prod
- 2025-08-12 MEDIUM: Authenticated (Editor+) PHP Object Injection (up to 2.11.16). CVE-2025-54012, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4f8c1a4-a309-4852-a066-0644ce175abc?source=api-prod
- 2025-07-16 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting (up to 2.11.16). CVE-2025-54013, https://www.wordfence.com/threat-intel/vulnerabilities/id/fe31346e-a06e-4b4d-b13c-7a98dca53274?source=api-prod
- 2025-06-03 MEDIUM: Authenticated (Editor+) Arbitrary File Deletion (up to 2.11.13). CVE-2025-47511, https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8f8319-d75f-4e71-90d4-1c60b5a8df90?source=api-prod
- 2025-02-11 HIGH: Unauthenticated Stored Cross-Site Scripting via name Parameter (up to 2.11.9). CVE-2025-0511, https://www.wordfence.com/threat-intel/vulnerabilities/id/6c26270b-a0a7-4877-aa66-bffe260003df?source=api-prod
- 2024-09-18 MEDIUM: Authenticated (Admin+) SQL Injection (up to 2.11.1). CVE-2024-42404, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7b15ba-5d7b-448d-ae95-b7d3ae7ff1c0?source=api-prod
- 2024-04-12 MEDIUM: Missing Authorization (up to 2.9.14). CVE-2024-32144, https://www.wordfence.com/threat-intel/vulnerabilities/id/61799fbc-05dc-4de9-90f9-8712ba554607?source=api-prod
- 2023-12-21 HIGH: Authenticated(Editor+) SQL Injection (before 2.9.4). CVE-2023-50847, https://www.wordfence.com/threat-intel/vulnerabilities/id/a328643a-ab12-427e-9bcd-2d40738afb61?source=api-prod
- 2023-12-08 MEDIUM: Authenticated (Administrator+) Directory Traversal (up to 2.9.6). CVE-2023-6120, https://www.wordfence.com/threat-intel/vulnerabilities/id/2677cea6-d60d-4e10-afd7-e088a5592b19?source=api-prod
- 2023-11-15 HIGH: Authenticated (Administrator+) PHP Object Injection (before 2.9.6). WF-91f86c22-94db-4c43-985a-2f3dd96ece21, https://www.wordfence.com/threat-intel/vulnerabilities/id/91f86c22-94db-4c43-985a-2f3dd96ece21?source=api-prod
- 2023-11-14 HIGH: Cross-Site Request Forgery (up to 2.9.4). WF-f59004bb-b026-4137-a332-f46a09237e7b, https://www.wordfence.com/threat-intel/vulnerabilities/id/f59004bb-b026-4137-a332-f46a09237e7b?source=api-prod
- 2023-11-14 HIGH: Authenticated (Subscriber+) Arbitrary File Upload (up to 2.9.4). CVE-2023-5953, https://www.wordfence.com/threat-intel/vulnerabilities/id/f690e67c-119f-4ea6-9505-101e7f7a3dea?source=api-prod
- 2023-11-10 MEDIUM: Reflected Cross-Site Scripting (up to 2.9.4). CVE-2023-5951, https://www.wordfence.com/threat-intel/vulnerabilities/id/162afd58-3534-401b-9119-c1c26e15cd0f?source=api-prod
- 2023-11-10 CRITICAL: Unauthenticated PHP Object Injection (up to 2.9.4). CVE-2023-5952, https://www.wordfence.com/threat-intel/vulnerabilities/id/23399606-20b6-4d0b-b613-06dc838dc1e7?source=api-prod
- 2023-09-26 HIGH: Authenticated(Editor+) Arbitrary File Upload (up to 2.8.21). CVE-2023-40219, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5eb9b1f-39d5-4c5d-8fb3-71d4bbe5f43a?source=api-prod
- 2023-09-14 HIGH: Authenticated(level_5+) SQL Injection via get_logs (before 2.8.22). CVE-2023-43493, https://www.wordfence.com/threat-intel/vulnerabilities/id/35dadb9c-f0c6-4b74-bb31-5e9d504b3db5?source=api-prod
- 2023-09-14 HIGH: Authenticated(Editor+) SQL Injection (before 2.8.22). CVE-2023-43610, https://www.wordfence.com/threat-intel/vulnerabilities/id/a908ac17-666f-4725-86f4-c9af4589fb69?source=api-prod
- 2023-01-27 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 2.8.10). CVE-2023-22705, https://www.wordfence.com/threat-intel/vulnerabilities/id/772c9330-97d5-42d5-a49c-d9a86a14b235?source=api-prod
- 2022-12-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 2.8.8). CVE-2022-4655, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4c9a5b-93ec-4979-921a-91134cb09566?source=api-prod
- 2022-12-05 MEDIUM: Authenticated (Subscriber+) Information Disclosure and PHAR deserialization (up to 2.8.5). CVE-2022-4237, https://www.wordfence.com/threat-intel/vulnerabilities/id/518be2c6-36ca-4015-8b7f-451a806c7b1d?source=api-prod
- 2022-12-05 MEDIUM: Authenticated (Subscriber+) Arbitrary File Read (up to 2.8.4). CVE-2022-4236, https://www.wordfence.com/threat-intel/vulnerabilities/id/f87df7cc-54bb-454c-94be-c8c4768cbe44?source=api-prod
- 2022-11-30 HIGH: Information Disclosure via Arbitrary File Read (2.6.10 to 2.8.4). CVE-2022-4140, https://www.wordfence.com/threat-intel/vulnerabilities/id/bdfabd43-0ffa-4c25-aa72-0572e7007a01?source=api-prod
- 2022-11-28 HIGH: Cross-Site Request Forgery (up to 2.8.3). WF-3b71805c-15bb-4cde-b91f-4f3e9b7ab520, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b71805c-15bb-4cde-b91f-4f3e9b7ab520?source=api-prod
- 2022-11-21 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 2.8.3). CVE-2022-3935, https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0ed141-3d17-4fff-b788-7ff43f79d04c?source=api-prod
- 2022-11-21 MEDIUM: Missing Authorization (up to 2.8.3). CVE-2022-3946, https://www.wordfence.com/threat-intel/vulnerabilities/id/b27b2e40-c703-4fa0-bff0-788e7a0351c6?source=api-prod
- 2022-11-16 HIGH: Cross-Site Request Forgery (up to 2.8.3). WF-d6572568-5586-4ed9-b0e2-32509b42ed31, https://www.wordfence.com/threat-intel/vulnerabilities/id/d6572568-5586-4ed9-b0e2-32509b42ed31?source=api-prod
- 2022-09-02 HIGH: Information Disclosure via Arbitrary File Read (2.6.0 to 2.7.7). CVE-2022-41840, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8ab165-57b8-4509-86b8-6e5226812264?source=api-prod
- 2021-08-06 HIGH: Missing Capabilities Check to Information Disclosure (before 2.2.8). CVE-2021-4355, https://www.wordfence.com/threat-intel/vulnerabilities/id/671f5ba5-1f18-49fa-aa97-eaebdb3417bb?source=api-prod
- 2021-08-06 MEDIUM: Missing Capabilities Check to Information Disclosure (before 2.2.8). CVE-2021-4375, https://www.wordfence.com/threat-intel/vulnerabilities/id/d82e856b-c8c9-4139-ad54-89368e3b7125?source=api-prod
- 2021-06-11 MEDIUM: Reflected Cross-Site Scripting (up to 2.2.3). CVE-2021-20734, https://www.wordfence.com/threat-intel/vulnerabilities/id/513f4a39-afba-4819-abf2-6ed168d11dfe?source=api-prod
- 2021-02-08 HIGH: SQL Injection (up to 2.1.0). WF-e7ecd712-a7b3-40e2-b982-be8b58e9b8c3, https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ecd712-a7b3-40e2-b982-be8b58e9b8c3?source=api-prod
- 2020-11-05 HIGH: PHP Object Injection (before 1.9.36). CVE-2020-28339, https://www.wordfence.com/threat-intel/vulnerabilities/id/6c694bce-e389-492a-827d-ae5293730612?source=api-prod
- 2016-06-24 MEDIUM: Cross-Site Scripting (up to 1.8.2). CVE-2016-4827, https://www.wordfence.com/threat-intel/vulnerabilities/id/103ce24e-1c21-4c25-b3d0-6f595bf58979?source=api-prod
- 2016-06-24 CRITICAL: Authentication Bypass (up to 1.8.2). CVE-2016-4828, https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8f6ade-84a2-4a42-9208-a74f5ebe19b3?source=api-prod
- 2016-06-24 HIGH: Object Injection (before 1.8.3). CVE-2016-4825, https://www.wordfence.com/threat-intel/vulnerabilities/id/321d0121-5cc9-4736-89b0-228e45b48b48?source=api-prod
- 2016-06-24 MEDIUM: Reflected Cross-Site Scripting (before 1.8.3). CVE-2016-4826, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b86a774-a420-41a8-85ad-44fe8b32d4c2?source=api-prod
- 2015-12-17 HIGH: SQL Injection (before 1.5.3). CVE-2015-7791, https://www.wordfence.com/threat-intel/vulnerabilities/id/be6c08b9-bba7-4780-99b9-4b80e6b4872a?source=api-prod
- 2015-07-15 HIGH: Multiple Cross-Site Scripting (before 1.4.18). CVE-2015-2973, https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2edcdf-3a0c-40bc-8b33-1ad15cad5acb?source=api-prod
- 2014-03-04 CRITICAL: SQL Injection (up to 2.9.1). CVE-2014-10017, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f23aa0e-eb1f-4310-9615-d67eb39389fe?source=api-prod
- 2014-03-03 MEDIUM: Cross-Site Scripting (up to 2.11.1). CVE-2014-10016, https://www.wordfence.com/threat-intel/vulnerabilities/id/d681fcaf-c7b3-496f-b0d8-a8ed48901cec?source=api-prod
- 2012-12-14 MEDIUM: Cross-Site Scripting (before 1.2.2). CVE-2012-5177, https://www.wordfence.com/threat-intel/vulnerabilities/id/16a4ebde-7c92-4ad2-9c8d-3bef0a8c600b?source=api-prod
- 2012-12-14 HIGH: Cross-Site Request Forgery (before 1.2.2). CVE-2012-5178, https://www.wordfence.com/threat-intel/vulnerabilities/id/2022fa8b-2b2a-43a3-9447-90eed326f187?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=usc-e-shop · HTML: https://todaywp.com/plugins/usc-e-shop