uscnanbu Welcart e-Commerce

• CVE-2026-119166 Medium 5.3 Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter 0.3%
• CVE-2026-118070 High 7.2 Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter 0.2%
• CVE-2026-107752 Medium 4.9 Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie 0.3%
• CVE-2026-87091 High 7.2 Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters 0.3%
• CVE-2026-19887 High 8.8 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback 1.1%
• CVE-2026-19914 High 7.2 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter 0.5%
• CVE-2025-12979 Medium 5.3 Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure 0.3%
• CVE-2025-10651 Medium 5.5 Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail 0.2%
• CVE-2025-10649 Medium 6.5 Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie 0.3%
• CVE-2025-9367 Medium 5.5 Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting 0.2%
• CVE-2025-0511 High 7.2 Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter 0.4%
• CVE-2023-6120 Medium 4.1 Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal 0.5%
• CVE-2021-4375 Medium 4.3 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure 0.6%
• CVE-2021-4355 High 7.5 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure 0.8%