Skip to content
fr Sign in
6.8 Medium

CVE-2026-111027 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using…

Description

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.

Affected products and versions

Product Affected versions Fixed in
Welcart e-Commerce 2.12 earliest → < 2.12.6 2.12.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Welcart e-Commerce

The 16 CVEs of Welcart e-Commerce →
CVE-2026-111031 The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a… 4.7 Medium CVE-2026-111032 The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted… 3.8 Low CVE-2025-15671 The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and… 5.4 Medium CVE-2026-15213 The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store /… 5.3 Medium
Track this CVE