Unknown Welcart E-Commerce vulnerabilities

4 CVEs affecting Unknown Welcart E-Commerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-15671, published 2026-08-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16065, published 2026-08-06. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and…
CVE-2025-15671, published 2026-08-21. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an…
CVE-2026-16066, published 2026-08-12. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject…
CVE-2026-15213, published 2026-08-12. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from…