CVE-2014-10017: Welcart E-Commerce

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) changeSort or (2) switch parameter in the usces_itemedit page to wp-admin/admin.php.

Affected products

• Welcart E-Commerce: version 1.3.12 only

Published 2015-01-13. Last modified 2026-06-17.