Unknown Welcart e-Commerce

• CVE-2026-111032 Low 3.8 Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax 0.2%
• CVE-2026-111031 Medium 4.7 Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter 0.2%
• CVE-2026-111027 Medium 6.8 Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter 0.3%
• CVE-2025-15671 Medium 5.4 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter 0.3%
• CVE-2026-15213 Medium 5.3 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback 0.2%
• CVE-2026-16066 Medium 5.4 Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name 0.2%
• CVE-2026-16065 Medium 6.5 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import 0.4%
• CVE-2023-5951 Medium 6.1 Welcart e-Commerce < 2.9.5 - Reflected XSS 0.5%
• CVE-2023-5953 High 8.8 Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload 0.5%
• CVE-2023-5952 Unrated Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection 1.3%
• CVE-2022-4655 Medium 5.4 Welcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via Shortcode 0.5%
• CVE-2022-4237 High 8.8 Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation 1.1%
• CVE-2022-4236 Medium 6.5 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access 0.9%
• CVE-2022-4140 High 7.5 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access 3.2%
• CVE-2022-3946 Medium 6.5 Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion 0.3%
• CVE-2022-3935 Medium 5.4 Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting 0.5%