Welcart e-Commerce vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

WE

Product

Welcart e-Commerce

by · last CVE Oct 28, 2026

7

CVEs

0

On KEV

6.5

Max CVSS

3

New 30D

Vulnerabilities7 In the news0 Timeline

Severity mix

Critical 0High 0Medium 4Low 0

Severity

All severities7 Critical0 High0 Medium4 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Welcart e-Commerce to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-16065	6.5	0%	Aug 6	Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import Affected: before 2.11.32
CVE-2025-15671	5.4	0%	Aug 21	Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter Affected: before 2.12.1
CVE-2026-16066	5.4	0%	Aug 12	Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name Affected: before 2.11.34
CVE-2026-15213	5.3	0%	Aug 12	Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback Affected: before 2.11.33
CVE-2026-111032 New	–	–	Oct 28	Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax Affected: before 2.12.6
CVE-2026-111031 New	–	–	Oct 28	Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter Affected: before 2.12.6
CVE-2026-111027 New	–	–	Oct 28	Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter Affected: before 2.12.6