PatchTheCVEwelcart vulnerabilities
Recent CVEs affecting welcart products. 6 tracked.
welcart has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-06-09. Highest priority: CVE-2025-27130 (score 41/100).
- CVE-2025-47511 MEDIUM 6.8 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart W
- CVE-2025-27130 HIGH 8.8 UPGRADE Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability
- CVE-2025-0511 HIGH 7.2 UPGRADE The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parame
- CVE-2024-45366 MEDIUM 6.1 UPGRADE Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability
- CVE-2024-42404 HIGH 8.8 UPGRADE SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the prod
- CVE-2024-32144 MEDIUM 5.4 UPGRADE Missing Authorization vulnerability in Welcart Inc
FAQ
How do I fix welcart vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is welcart being exploited right now?
None of the tracked welcart CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which welcart CVE should I patch first?
CVE-2025-27130 currently ranks highest (41/100): Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability.