Skip to content
PluginCanary

Welcart e-Commerce

by info@welcart · 10,000+ active installs · Checked 3 Nov 2026
Healthy14 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 2.12.6.

81/ 100 Canary Score
Sub-scores for Welcart e-Commerce
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 2.12.6. Update to version 2.12.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 2.12.6. Update to version 2.12.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 2.12.6. Update to version 2.12.6 or later.28 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 2.12.6. Update to version 2.12.6 or later.28 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 26 Oct 2026, fixed in 2.12.6. Update to version 2.12.6 or later.26 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 16 Oct 2026, fixed in 2.12.5. Update to version 2.12.5 or later.16 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 3 Oct 2026, fixed in 2.12.4. Update to version 2.12.4 or later.3 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 2.12.3. Update to version 2.12.3 or later.2 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 4 Sep 2026, fixed in 2.12.2. Update to version 2.12.2 or later.4 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 31 Aug 2026, fixed in 2.12.2. Update to version 2.12.2 or later.31 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 19 Aug 2026, fixed in 2.12.1. Update to version 2.12.1 or later.19 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 14 Aug 2026, fixed in 2.11.33. Update to version 2.11.33 or later.14 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 11 Aug 2026, fixed in 2.11.32. Update to version 2.11.32 or later.11 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 2.11.34. Update to version 2.11.34 or later.10 Aug 2026Evidence
  • InfoSEC-326 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
uscnanbu27 Jan 2011 to 4 Nov 2026, 2002 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
38
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Welcart e-Commerce
Q1 20245
Q2 20245
Q3 20246
Q4 20244
Q1 20255
Q2 20255
Q3 20254
Q4 20255
Q1 20261
Q2 20263
Q3 202610
Q4 20263

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter5.3<= 2.12.52.12.60
30 Oct 2026Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter7.2<= 2.12.52.12.60
28 Oct 2026Welcart e-Commerce < 2.12.6 - Authenticated (Editor+) SQL Injection4.9< 2.12.62.12.60
28 Oct 2026Welcart e-Commerce < 2.12.6 - Missing Authorization4.3< 2.12.62.12.60
26 Oct 2026Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect4.7< 2.12.62.12.60
16 Oct 2026Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie4.9<= 2.12.42.12.50
3 Oct 2026Welcart e-Commerce <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.12.32.12.40
2 Oct 2026Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters7.2<= 2.12.22.12.30
4 Sep 2026Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback8.8<= 2.12.12.12.20
31 Aug 2026Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter7.2<= 2.12.12.12.20
19 Aug 2026Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation6.5< 2.12.12.12.10
14 Aug 2026Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass5.3< 2.11.332.11.330
11 Aug 2026Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.11.312.11.320
10 Aug 2026Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 2.11.332.11.340
31 Jul 2026Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection4.9<= 2.11.312.11.320
4 Jun 2026Welcart e-Commerce <= 2.11.28 - Missing Authorization5.3<= 2.11.282.11.290
12 Nov 2025Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure5.3<= 2.11.242.11.250
21 Oct 2025Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail5.5<= 2.11.222.11.230
14 Oct 2025Welcart e-Commerce <= 2.11.24 - Missing Authorization4.3<= 2.11.242.11.2529
7 Oct 2025Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie6.5<= 2.11.212.11.220
9 Sep 2025Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting5.5<= 2.11.202.11.210
9 Sep 2025Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 2.11.202.11.210
12 Aug 2025Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection6.6<= 2.11.162.11.170
16 Jul 2025Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting5.5<= 2.11.162.11.170
3 Jun 2025Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion6.5<= 2.11.132.11.140

Source: Wordfence Intelligence.

Reputation

Average rating fell from 5.0 to 4.0 between Q1 2024 and Q3 2025.

Rating distribution
5 star4
4 star1
3 star1
2 star0
1 star0

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Welcart e-Commerce
4 May 2026344
11 May 2026383
18 May 2026421
25 May 2026376
1 Jun 20268,660
8 Jun 2026746
15 Jun 2026544
22 Jun 2026459
29 Jun 202616,596
6 Jul 2026893
13 Jul 2026563
20 Jul 2026582
27 Jul 20269,062
3 Aug 202617,310
10 Aug 2026973
17 Aug 20262,562
24 Aug 20261,043
31 Aug 20263,426
7 Sep 202610,475
14 Sep 20264,761
21 Sep 20265,634
28 Sep 2026876
5 Oct 20261,084
12 Oct 20265,584
19 Oct 20267,370
26 Oct 20262,048
2 Nov 20265,678

Weekly downloads over the last 4 weeks are 29% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Commerce7 for WordPressScore 91 · 1,000+External Store for ShopifyScore 87 · 2,000+Product Catalog SimpleScore 86 · 1,000+WooCommerceScore 85 · 7,000,000+Easy Digital Downloads - eCommerce Payments and Subscriptions made easyScore 85 · 40,000+

Facts

Version2.12.7
Authorinfo@welcart
Added23 Oct 2009
Last updated2 Nov 2026
Active installs10,000+
Requires WordPress5.6
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagscart, store, Welcart, shopping, e-commerce

Other plugins by this author: e-SCOTT Smart pro for WooCommerce, Failure

Questions

Is Welcart e-Commerce still maintained?

Welcart e-Commerce was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is Welcart e-Commerce safe?

Welcart e-Commerce has no open unpatched vulnerabilities on record. 26 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Welcart e-Commerce?

The wordpress.org author is info@welcart. Recent committers: uscnanbu. We have recorded no ownership change.

What can I use instead of Welcart e-Commerce?

Plugins in the same category with a higher Canary Score: Commerce7 for WordPress, External Store for Shopify, Product Catalog Simple, WooCommerce, Easy Digital Downloads - eCommerce Payments and Subscriptions made easy.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue