PLUGIN SECURITY
Is Usc E Shop safe?
Welcart is a free WordPress e-commerce plugin with the top market share in Japan.
What this plugin does
- Slug:
usc-e-shop - Author: info@welcart
- 10000+ active installs
- 90/100 rating (6 reviews on wordpress.org)
- 1385796 all-time downloads
- On WordPress.org since 2009-10-23
carte-commerceshoppingstoreWelcart
Maintenance status
- Last updated: 2026-11-04 1:41am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
68 known CVEs on file for Usc E Shop.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-119503 | Welcart e-Commerce [usc-e-shop] < 2.12.7 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 6.5 | < 2.12.7 | 2.12.7 | 2026-11-09 | — |
| CVE-2026-119505 | Welcart e-Commerce [usc-e-shop] < 2.12.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.12.7 | 2.12.7 | 2026-11-07 | — |
| CVE-2026-120597 | Welcart e-Commerce [usc-e-shop] <= 2.12.6 (unfixed) | — | Medium 4.3 | < 2.12.6 | 2.12.6 | 2026-11-02 | — |
| CVE-2026-118070 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 2.12.6 | 2.12.6 | 2026-10-30 | — |
| CVE-2026-119166 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Improper Authentication | Medium 5.3 | < 2.12.6 | 2.12.6 | 2026-10-30 | — |
| CVE-2026-111032 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Incorrect Authorization | Unknown | < 2.12.6 | 2.12.6 | 2026-10-28 | — |
| CVE-2026-111031 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | URL Redirection to Untrusted Site ('Open Redirect') | Unknown | < 2.12.6 | 2.12.6 | 2026-10-28 | — |
| CVE-2026-111027 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 2.12.6 | 2.12.6 | 2026-10-28 | — |
+ 86 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-96761 | Welcart e-Commerce [usc-e-shop] < 2.12.4 | — | High 7.1 | < 2.12.4 | 2.12.4 | 2026-10-09 | — |
| CVE-2026-107752 | Welcart e-Commerce [usc-e-shop] < 2.12.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 2.12.5 | 2.12.5 | 2026-10-03 | — |
| CVE-2026-87091 | Welcart e-Commerce [usc-e-shop] < 2.12.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 2.12.3 | 2.12.3 | 2026-09-04 | — |
| CVE-2026-19887 | Welcart e-Commerce [usc-e-shop] < 2.12.2 | Deserialization of Untrusted Data | High 8.8 | < 2.12.2 | 2.12.2 | 2026-08-31 | — |
| CVE-2025-15671 | Welcart e-Commerce [usc-e-shop] < 2.12.1 | Improper Authentication | Unknown | < 2.12.1 | 2.12.1 | 2026-08-21 | — |
| CVE-2026-19914 | Welcart e-Commerce [usc-e-shop] < 2.12.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 2.12.2 | 2.12.2 | 2026-08-14 | — |
| CVE-2026-15213 | Welcart e-Commerce [usc-e-shop] < 2.11.33 | Insufficient Verification of Data Authenticity | Medium 5.3 | < 2.11.33 | 2.11.33 | 2026-08-11 | — |
| CVE-2026-27539 | Welcart e-Commerce [usc-e-shop] < 2.11.32 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.11.32 | 2.11.32 | 2026-08-11 | — |
| CVE-2026-16066 | Welcart e-Commerce [usc-e-shop] < 2.11.34 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.11.34 | 2.11.34 | 2026-08-10 | — |
| CVE-2026-16065 | Welcart e-Commerce [usc-e-shop] < 2.11.32 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 2.11.32 | 2.11.32 | 2026-07-31 | — |
| CVE-2026-49775 | Welcart e-Commerce [usc-e-shop] < 2.11.29 | Missing Authorization | Medium 6.5 | < 2.11.29 | 2.11.29 | 2026-06-04 | — |
| CVE-2025-12979 | Welcart e-Commerce [usc-e-shop] < 2.11.25 | Missing Authorization | Medium 5.3 | < 2.11.25 | 2.11.25 | 2025-11-12 | — |
| CVE-2025-10651 | Welcart e-Commerce [usc-e-shop] < 2.11.23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.5 | < 2.11.23 | 2.11.23 | 2025-10-21 | — |
| CVE-2025-62953 | Welcart e-Commerce [usc-e-shop] < 2.11.25 | Missing Authorization | Medium 4.3 | < 2.11.25 | 2.11.25 | 2025-10-14 | — |
| CVE-2025-10649 | Welcart e-Commerce [usc-e-shop] < 2.11.22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 2.11.22 | 2.11.22 | 2025-10-07 | — |
| CVE-2025-58984 | Welcart e-Commerce [usc-e-shop] < 2.11.21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 2.11.21 | 2.11.21 | 2025-09-09 | — |
| CVE-2025-54012 | Welcart e-Commerce [usc-e-shop] < 2.11.17 | Deserialization of Untrusted Data | High 7.2 | < 2.11.17 | 2.11.17 | 2025-08-12 | — |
| CVE-2025-54013 | Welcart e-Commerce [usc-e-shop] < 2.11.17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 2.11.17 | 2.11.17 | 2025-07-16 | — |
| CVE-2025-47511 | Welcart e-Commerce [usc-e-shop] < 2.11.14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 6.5 | < 2.11.14 | 2.11.14 | 2025-06-03 | — |
| CVE-2025-27130 | Welcart e-Commerce [usc-e-shop] < 2.11.12 | — | Medium 6.3 | < 2.11.12 | 2.11.12 | 2025-04-01 | — |
| CVE-2024-42404 | Welcart e-Commerce [usc-e-shop] < 2.11.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 2.11.2 | 2.11.2 | 2024-09-18 | — |
| CVE-2024-45366 | Welcart e-Commerce [usc-e-shop] < 2.11.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.11.2 | 2.11.2 | 2024-09-18 | — |
| CVE-2024-32144 | Welcart e-Commerce [usc-e-shop] < 2.10.0 | Missing Authorization | Medium 4.3 | < 2.10.0 | 2.10.0 | 2024-04-12 | — |
| CVE-2023-50847 | Welcart e-Commerce [usc-e-shop] < 2.9.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.6 | < 2.9.4 | 2.9.4 | 2023-12-21 | — |
| CVE-2023-6120 | Welcart e-Commerce [usc-e-shop] < 2.9.7 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Low 2.7 | < 2.9.7 | 2.9.7 | 2023-12-08 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.6 | — | Unknown | < 2.9.6 | 2.9.6 | 2023-11-15 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.6 | — | Unknown | < 2.9.6 | 2.9.6 | 2023-11-15 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.5 | — | Unknown | < 2.9.5 | 2.9.5 | 2023-11-14 | — |
| CVE-2023-5953 | Welcart e-Commerce [usc-e-shop] < 2.9.5 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 2.9.5 | 2.9.5 | 2023-11-14 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.5 | — | Unknown | < 2.9.5 | 2.9.5 | 2023-11-14 | — |
| CVE-2023-5952 | Welcart e-Commerce [usc-e-shop] < 2.9.5 | Deserialization of Untrusted Data | Critical 9.8 | < 2.9.5 | 2.9.5 | 2023-11-10 | — |
| CVE-2023-5951 | Welcart e-Commerce [usc-e-shop] < 2.9.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.9.5 | 2.9.5 | 2023-11-10 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.8.22 | — | Unknown | < 2.8.22 | 2.8.22 | 2023-09-15 | — |
| CVE-2023-43493 | Welcart e-Commerce [usc-e-shop] < 2.8.22 | — | Unknown | < 2.8.22 | 2.8.22 | 2023-09-14 | — |
| CVE-2023-40219 | Welcart e-Commerce [usc-e-shop] >= 2.7 - <= 2.8.21 | Unrestricted Upload of File with Dangerous Type | High 7.2 | 2.7–2.8.22 | 2.8.22 | 2023-09-14 | — |
| CVE-2023-22705 | Welcart e-Commerce [usc-e-shop] < 2.8.11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.8.11 | 2.8.11 | 2023-01-27 | — |
| CVE-2022-4655 | Welcart e-Commerce [usc-e-shop] < 2.8.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.8.9 | 2.8.9 | 2022-12-23 | — |
| CVE-2022-4237 | Welcart e-Commerce [usc-e-shop] < 2.8.6 | Deserialization of Untrusted Data | High 8.8 | < 2.8.6 | 2.8.6 | 2022-12-05 | — |
| CVE-2022-4236 | Welcart e-Commerce [usc-e-shop] < 2.8.5 | Files or Directories Accessible to External Parties | Medium 6.5 | < 2.8.5 | 2.8.5 | 2022-12-05 | — |
| CVE-2022-4140 | Welcart e-Commerce [usc-e-shop] < 2.8.5 | Files or Directories Accessible to External Parties | High 7.5 | < 2.8.5 | 2.8.5 | 2022-11-30 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.8.4 | — | Unknown | < 2.8.4 | 2.8.4 | 2022-11-28 | — |
| CVE-2022-3946 | Welcart e-Commerce [usc-e-shop] < 2.8.4 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 2.8.4 | 2.8.4 | 2022-11-21 | — |
| CVE-2022-3935 | Welcart e-Commerce [usc-e-shop] < 2.8.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.8.4 | 2.8.4 | 2022-11-21 | — |
| CVE-2022-41840 | Welcart e-Commerce [usc-e-shop] < 2.7.8 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 2.7.8 | 2.7.8 | 2022-09-02 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Unknown | < 2.2.8 | 2.2.8 | 2021-08-06 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Unknown | < 2.2.8 | 2.2.8 | 2021-08-06 | — |
| CVE-2021-4355, CVE-2021-4375 | Welcart e-Commerce [usc-e-shop] < 2.2.8 | Missing Authorization | Medium 5.3 | < 2.2.8 | 2.2.8 | 2021-08-06 | — |
| CVE-2021-20734 | Welcart e-Commerce [usc-e-shop] < 2.2.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.2.4 | 2.2.4 | 2021-06-11 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.0.1 | — | Unknown | < 2.0.1 | 2.0.1 | 2021-02-09 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.1.1 | — | Unknown | < 2.1.1 | 2.1.1 | 2021-02-08 | — |
| CVE-2020-28339 | Welcart e-Commerce [usc-e-shop] < 1.9.36 | Deserialization of Untrusted Data | High 8.8 | < 1.9.36 | 1.9.36 | 2020-11-05 | — |
| CVE-2016-4826 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.8.3 | 1.8.3 | 2016-06-24 | — |
| CVE-2016-4825 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | Improper Input Validation | Medium 5.6 | < 1.8.3 | 1.8.3 | 2016-05-17 | — |
| CVE-2016-4828 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | — | Medium 6.5 | < 1.8.3 | 1.8.3 | 2016-05-17 | — |
| CVE-2016-4827 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.8.3 | 1.8.3 | 2016-05-17 | — |
| CVE-2015-7791 | Welcart e-Commerce [usc-e-shop] < 1.5.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.3 | < 1.5.3 | 1.5.3 | 2015-10-09 | — |
| — | Welcart e-Commerce [usc-e-shop] < 1.1 | — | Unknown | < 1.1 | 1.1 | 2015-07-25 | — |
| CVE-2015-2973 | Welcart e-Commerce [usc-e-shop] < 1.4.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 1.4.18 | 1.4.18 | 2015-04-07 | — |
| CVE-2014-10017 | Welcart e-Commerce [usc-e-shop] < 1.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5 | 1.5 | 2014-03-04 | — |
| CVE-2014-10016 | Welcart e-Commerce [usc-e-shop] < 1.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 1.5 | 1.5 | 2014-03-03 | — |
| CVE-2012-5177 | Welcart e-Commerce [usc-e-shop] < 1.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 1.2.2 | 1.2.2 | 2012-09-26 | — |
| CVE-2012-5178 | Welcart e-Commerce [usc-e-shop] < 1.2.2 | Cross-Site Request Forgery (CSRF) | Unknown | < 1.2.2 | 1.2.2 | 2012-09-26 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.11.10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.11.10 | 2.11.10 | 0000-00-00 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.11.21 | — | Unknown | < 2.11.21 | 2.11.21 | 0000-00-00 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Unknown | < 2.2.8 | 2.2.8 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Unknown | < 2.2.8 | 2.2.8 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.1.1 | — | Unknown | < 2.1.1 | 2.1.1 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 1.8.3 | — | Unknown | < 1.8.3 | 1.8.3 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 1.5 | — | Unknown | < 1.5 | 1.5 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.5 | — | Unknown | < 2.9.5 | 2.9.5 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.6 | — | Unknown | < 2.9.6 | 2.9.6 | — | — |
| — | Welcart e-Commerce 1.3.12 - DOM Cross-Site Scripting (XSS) | — | Unknown | < 1.5 | 1.5 | — | — |
| — | Welcart e-Commerce < 1.8.3 - Session Management | — | Unknown | < 1.8.3 | 1.8.3 | — | — |
| — | Welcart e-Commerce < 2.1.1 - Authenticated SQL Injection | — | Unknown | < 2.1.1 | 2.1.1 | — | — |
| CVE-2021-20734 | Welcart e-Commerce < 2.2.4 - Cross-Site Scripting (XSS) | — | Unknown | < 2.2.4 | 2.2.4 | — | — |
| CVE-2021-4355 | Welcart e-Commerce < 2.2.8 - Unauthenticated Information Disclosure | — | Unknown | < 2.2.8 | 2.2.8 | — | — |
| CVE-2021-4375 | Welcart e-Commerce < 2.2.8 - Authenticated System Information Disclosure | — | Unknown | < 2.2.8 | 2.2.8 | — | — |
| CVE-2023-43610 | Welcart e-Commerce < 2.8.22 - Editor+ SQL Injection | — | Unknown | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-43493 | Welcart e-Commerce < 2.8.22 - Author+ SQL Injection | — | Unknown | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-41233, CVE-2023-41962, CVE-2023-43484, CVE-2023-43614 | Welcart e-Commerce < 2.8.22 - Multiple XSS | — | Unknown | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-40532 | Welcart e-Commerce < 2.8.22 - Author+ Path Traversal | — | Unknown | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-5953 | Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload | — | Unknown | < 2.9.5 | 2.9.5 | — | — |
| — | Welcart e-Commerce < 2.9.5 - Cross-Site Request Forgery | — | Unknown | < 2.9.5 | 2.9.5 | — | — |
| — | Welcart e-Commerce < 2.9.6 - Admin+ PHP Object Injection | — | Unknown | < 2.9.6 | 2.9.6 | — | — |
| CVE-2025-0511 | Welcart e-Commerce < 2.11.10 - Unauthenticated Stored Cross-Site Scripting via name Parameter | — | Unknown | < 2.11.10 | 2.11.10 | — | — |
| CVE-2025-9367 | Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting | — | Unknown | < 2.11.21 | 2.11.21 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Menu Cart for WooCommerce — 70000+ active installs — 92/100 (99) — max PHP 8.4
- WCBoost – Wishlist — 40000+ active installs — max PHP 8.4
- Klarna for WooCommerce — 20000+ active installs — 46/100 (20) — max PHP 8.4
- Ecwid by Lightspeed Ecommerce Shopping Cart — 20000+ active installs — 90/100 (228) — max PHP 8.4
- Conversion Tracking for WooCommerce — 20000+ active installs — 60/100 (24)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.