Skip to content
fr Sign in
6.1 Medium

CVE-2023-5951 The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it…

Description

The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products and versions

Product Affected versions Fixed in
Welcart e-Commerce 2.9 earliest → < 2.9.5 2.9.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Welcart e-Commerce

The 16 CVEs of Welcart e-Commerce →
CVE-2026-111031 The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a… 4.7 Medium CVE-2026-111032 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted… 3.8 Low CVE-2026-111027 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using… 6.8 Medium CVE-2025-15671 The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and… 5.4 Medium
Track this CVE