Known vulnerabilities in Welcart e-Commerce
Welcart is a free WordPress e-commerce plugin with the top market share in Japan.
58Reported vulnerabilities
9.8Highest CVSS score
2.12.1Latest version
10,000+Active installs
What to do now
Update Welcart e-Commerce to 2.12.5 or later.
58 of these have a fixed version available. Updating resolves them.
Reported vulnerabilities
| CVE | Severity | Exploit probability |
Affected versions | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2023-5952 | Critical | 1.3% | Before 2.9.5 | 2.9.5 |
December 4, 2023 |
| CVE-2020-28339 | High | 1.9% | Before 1.9.36 | 1.9.36 |
November 7, 2020 |
| CVE-2022-4237 | High | 1.1% | Before 2.8.6 | 2.8.6 |
January 2, 2023 |
| CVE-2023-5953 | High | 0.5% | Before 2.9.5 | 2.9.5 |
December 4, 2023 |
| CVE-2022-4140 | High | 3.0% | Before 2.8.5 | 2.8.5 |
January 2, 2023 |
| CVE-2014-10017 | High | 2.3% | 1.3.12 to 1.3.12 (inclusive) | 2.9.2 |
January 13, 2015 |
| CVE-2022-41840 | Critical | 5.5% | Before 2.7.8 | 2.7.8 |
November 18, 2022 |
| CVE-2022-4236 | Medium | 0.8% | Before 2.8.5 | 2.8.5 |
January 2, 2023 |
| CVE-2022-3946 | Medium | 0.3% | Before 2.8.4 | 2.8.4 |
December 12, 2022 |
| CVE-2023-5951 | Medium | 0.5% | Before 2.9.5 | 2.9.5 |
December 4, 2023 |
| CVE-2021-4355 | Medium | 0.8% | 2.2.7 and earlier | 2.2.8 |
June 7, 2023 |
| CVE-2022-4655 | Medium | 0.5% | Before 2.8.9 | 2.8.9 |
January 16, 2023 |
| CVE-2022-3935 | Medium | 0.5% | Before 2.8.4 | 2.8.4 |
December 12, 2022 |
| CVE-2023-40219 | High | 1.2% | 2.8.21 and earlier | 2.8.22 |
September 26, 2023 |
| CVE-2023-43493 | High | 1.0% | Before 2.8.22 | 2.8.22 |
September 14, 2023 |
| CVE-2023-43610 | High | 1.2% | Before 2.8.22 | 2.8.22 |
September 14, 2023 |
| CVE-2014-10016 | Medium | 2.0% | 1.3.12 to 1.3.12 (inclusive) | 2.11.2 |
January 13, 2015 |
| CVE-2012-5178 | High | 1.1% | Before 1.2.2 | 1.2.2 |
December 14, 2012 |
| CVE-2026-19887 | High | 0.6% | 0 to 2.12.1 (inclusive) | 2.12.2 |
September 5, 2026 |
| WF-f59004bb-b026-4137-a332-f46a09237e7b | High | — | 2.9.4 and earlier | 2.9.5 |
November 14, 2023 |
| WF-3b71805c-15bb-4cde-b91f-4f3e9b7ab520 | High | — | 2.8.3 and earlier | 2.8.4 |
November 28, 2022 |
| WF-d6572568-5586-4ed9-b0e2-32509b42ed31 | High | — | 2.8.3 and earlier | 2.8.4 |
November 16, 2022 |
| WF-e7ecd712-a7b3-40e2-b982-be8b58e9b8c3 | High | — | 2.1.0 and earlier | 2.1.1 |
February 8, 2021 |
| CVE-2021-4375 | Medium | 0.6% | 2.2.7 and earlier | 2.2.8 |
June 7, 2023 |
| CVE-2026-87091 | High | 0.3% | 0 to 2.12.2 (inclusive) | 2.12.3 |
October 3, 2026 |
| CVE-2026-19914 | High | 0.3% | 0 to 2.12.1 (inclusive) | 2.12.2 |
September 1, 2026 |
| CVE-2026-27539 | High | 0.3% | 2.11.31 and earlier | 2.11.32 |
August 11, 2026 |
| CVE-2023-50847 | High | 0.5% | Before 2.9.4 | 2.9.4 |
December 21, 2023 |
| CVE-2023-22705 | High | 0.4% | 2.8.10 and earlier | 2.8.11 |
January 27, 2023 |
| CVE-2026-96761 | High | 0.1% | 2.12.3 and earlier | 2.12.4 |
October 3, 2026 |
| WF-91f86c22-94db-4c43-985a-2f3dd96ece21 | High | — | Before 2.9.6 | 2.9.6 |
November 15, 2023 |
| CVE-2016-4828 | Medium | 1.8% | Before 1.8.3 | 1.8.3 |
June 25, 2016 |
| CVE-2015-7791 | Medium | 1.6% | 1.5.2 and earlier | 1.5.3 |
December 29, 2015 |
| CVE-2025-54012 | Medium | 0.5% | 2.11.16 and earlier | 2.11.17 |
August 12, 2025 |
| CVE-2025-47511 | Medium | 0.5% | 2.11.13 and earlier | 2.11.14 |
June 3, 2025 |
| CVE-2016-4825 | Medium | 2.9% | Before 1.8.3 | 1.8.3 |
June 25, 2016 |
| CVE-2012-5177 | Medium | 1.9% | Before 1.2.2 | 1.2.2 |
December 14, 2012 |
| CVE-2025-15671 | Medium | 0.3% | Before 2.12.1 | 2.12.1 |
August 19, 2026 |
| CVE-2025-10649 | Medium | 0.3% | 0 to 2.11.21 (inclusive) | 2.11.22 |
October 8, 2025 |
| CVE-2021-20734 | Medium | 1.0% | 2.2.3 and earlier | 2.2.4 |
June 11, 2021 |
| CVE-2016-4827 | Medium | 1.5% | Before 1.8.3 | 1.8.3 |
June 25, 2016 |
| CVE-2016-4826 | Medium | 1.5% | Before 1.8.3 | 1.8.3 |
June 25, 2016 |
| CVE-2026-16066 | Medium | 0.2% | 2.11.33 and earlier | 2.11.34 |
August 10, 2026 |
| CVE-2025-0511 | Medium | 0.4% | Before 2.11.10 | 2.11.10 |
February 12, 2025 |
| CVE-2025-10651 | Medium | 0.2% | 0 to 2.11.22 (inclusive) | 2.11.23 |
October 22, 2025 |
| CVE-2025-9367 | Medium | 0.2% | 0 to 2.11.20 (inclusive) | 2.11.21 |
September 10, 2025 |
| CVE-2025-54013 | Medium | 0.2% | 2.11.16 and earlier | 2.11.17 |
July 16, 2025 |
| CVE-2024-32144 | Medium | 0.3% | 2.9.14 and earlier | 2.10.0 |
April 12, 2024 |
| CVE-2026-15213 | Medium | 0.2% | 0 up to (but not including) 2.11.33 | 2.11.33 |
August 12, 2026 |
| CVE-2026-49775 | Medium | 0.3% | 2.11.28 and earlier | 2.11.29 |
June 4, 2026 |
| CVE-2025-12979 | Medium | 0.3% | 2.11.24 and earlier | 2.11.25 |
November 12, 2025 |
| CVE-2015-2973 | Medium | 2.0% | 1.4.17 and earlier | 1.4.18 |
July 24, 2015 |
| CVE-2026-107752 | Medium | 0.3% | 0 to 2.12.4 (inclusive) | 2.12.5 |
October 17, 2026 |
| CVE-2026-16065 | Medium | 0.4% | 2.11.31 and earlier | 2.11.32 |
July 31, 2026 |
| CVE-2024-42404 | Medium | 0.5% | 2.11.1 and earlier | 2.11.2 |
September 18, 2024 |
| CVE-2025-62953 | Medium | 0.2% | 2.11.24 and earlier | 2.11.25 |
October 14, 2025 |
| CVE-2025-58984 | Medium | 0.2% | 2.11.20 and earlier | 2.11.21 |
September 9, 2025 |
| CVE-2023-6120 | Low | 0.5% | Before 2.9.7 | 2.9.7 |
December 9, 2023 |