SEGURIDAD DE PLUGINS
¿Es seguro Usc E Shop?
Welcart is a free WordPress e-commerce plugin with the top market share in Japan.
Qué hace este plugin
- Slug:
usc-e-shop - Autor: info@welcart
- 10000+ instalaciones activas
- 90/100 calificación (6 reseñas en wordpress.org)
- 1385796 descargas totales
- En WordPress.org desde 2009-10-23
carte-commerceshoppingstoreWelcart
Estado de mantenimiento
- Última actualización: 2026-11-04 1:41am GMT
- Probado hasta WordPress: 7.1.4
- Requiere PHP: 7.4+
- PHP máximo soportado (analizado): 8.4
Vulnerabilidades conocidas
68 CVEs conocidos registrados para Usc E Shop.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-119503 | Welcart e-Commerce [usc-e-shop] < 2.12.7 | Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) | Media 6,5 | < 2.12.7 | 2.12.7 | 2026-11-09 | — |
| CVE-2026-119505 | Welcart e-Commerce [usc-e-shop] < 2.12.7 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 2.12.7 | 2.12.7 | 2026-11-07 | — |
| CVE-2026-120597 | Welcart e-Commerce [usc-e-shop] <= 2.12.6 (unfixed) | — | Media 4,3 | < 2.12.6 | 2.12.6 | 2026-11-02 | — |
| CVE-2026-118070 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,2 | < 2.12.6 | 2.12.6 | 2026-10-30 | — |
| CVE-2026-119166 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Autenticación indebida | Media 5,3 | < 2.12.6 | 2.12.6 | 2026-10-30 | — |
| CVE-2026-111032 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Autorización incorrecta | Desconocido | < 2.12.6 | 2.12.6 | 2026-10-28 | — |
| CVE-2026-111031 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Redirección de URL a un sitio no confiable (Open Redirect) | Desconocido | < 2.12.6 | 2.12.6 | 2026-10-28 | — |
| CVE-2026-111027 | Welcart e-Commerce [usc-e-shop] < 2.12.6 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Desconocido | < 2.12.6 | 2.12.6 | 2026-10-28 | — |
+ 86 vulnerabilidades conocidas más
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-96761 | Welcart e-Commerce [usc-e-shop] < 2.12.4 | — | Alta 7,1 | < 2.12.4 | 2.12.4 | 2026-10-09 | — |
| CVE-2026-107752 | Welcart e-Commerce [usc-e-shop] < 2.12.5 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Media 4,9 | < 2.12.5 | 2.12.5 | 2026-10-03 | — |
| CVE-2026-87091 | Welcart e-Commerce [usc-e-shop] < 2.12.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,2 | < 2.12.3 | 2.12.3 | 2026-09-04 | — |
| CVE-2026-19887 | Welcart e-Commerce [usc-e-shop] < 2.12.2 | Deserialización de datos no confiables | Alta 8,8 | < 2.12.2 | 2.12.2 | 2026-08-31 | — |
| CVE-2025-15671 | Welcart e-Commerce [usc-e-shop] < 2.12.1 | Autenticación indebida | Desconocido | < 2.12.1 | 2.12.1 | 2026-08-21 | — |
| CVE-2026-19914 | Welcart e-Commerce [usc-e-shop] < 2.12.2 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,2 | < 2.12.2 | 2.12.2 | 2026-08-14 | — |
| CVE-2026-15213 | Welcart e-Commerce [usc-e-shop] < 2.11.33 | Verificación insuficiente de la autenticidad de los datos | Media 5,3 | < 2.11.33 | 2.11.33 | 2026-08-11 | — |
| CVE-2026-27539 | Welcart e-Commerce [usc-e-shop] < 2.11.32 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 2.11.32 | 2.11.32 | 2026-08-11 | — |
| CVE-2026-16066 | Welcart e-Commerce [usc-e-shop] < 2.11.34 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 2.11.34 | 2.11.34 | 2026-08-10 | — |
| CVE-2026-16065 | Welcart e-Commerce [usc-e-shop] < 2.11.32 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Desconocido | < 2.11.32 | 2.11.32 | 2026-07-31 | — |
| CVE-2026-49775 | Welcart e-Commerce [usc-e-shop] < 2.11.29 | Falta de control de autorización | Media 6,5 | < 2.11.29 | 2.11.29 | 2026-06-04 | — |
| CVE-2025-12979 | Welcart e-Commerce [usc-e-shop] < 2.11.25 | Falta de control de autorización | Media 5,3 | < 2.11.25 | 2.11.25 | 2025-11-12 | — |
| CVE-2025-10651 | Welcart e-Commerce [usc-e-shop] < 2.11.23 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,5 | < 2.11.23 | 2.11.23 | 2025-10-21 | — |
| CVE-2025-62953 | Welcart e-Commerce [usc-e-shop] < 2.11.25 | Falta de control de autorización | Media 4,3 | < 2.11.25 | 2.11.25 | 2025-10-14 | — |
| CVE-2025-10649 | Welcart e-Commerce [usc-e-shop] < 2.11.22 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Media 6,5 | < 2.11.22 | 2.11.22 | 2025-10-07 | — |
| CVE-2025-58984 | Welcart e-Commerce [usc-e-shop] < 2.11.21 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,9 | < 2.11.21 | 2.11.21 | 2025-09-09 | — |
| CVE-2025-54012 | Welcart e-Commerce [usc-e-shop] < 2.11.17 | Deserialización de datos no confiables | Alta 7,2 | < 2.11.17 | 2.11.17 | 2025-08-12 | — |
| CVE-2025-54013 | Welcart e-Commerce [usc-e-shop] < 2.11.17 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,9 | < 2.11.17 | 2.11.17 | 2025-07-16 | — |
| CVE-2025-47511 | Welcart e-Commerce [usc-e-shop] < 2.11.14 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 6,5 | < 2.11.14 | 2.11.14 | 2025-06-03 | — |
| CVE-2025-27130 | Welcart e-Commerce [usc-e-shop] < 2.11.12 | — | Media 6,3 | < 2.11.12 | 2.11.12 | 2025-04-01 | — |
| CVE-2024-42404 | Welcart e-Commerce [usc-e-shop] < 2.11.2 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 8,8 | < 2.11.2 | 2.11.2 | 2024-09-18 | — |
| CVE-2024-45366 | Welcart e-Commerce [usc-e-shop] < 2.11.2 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.11.2 | 2.11.2 | 2024-09-18 | — |
| CVE-2024-32144 | Welcart e-Commerce [usc-e-shop] < 2.10.0 | Falta de control de autorización | Media 4,3 | < 2.10.0 | 2.10.0 | 2024-04-12 | — |
| CVE-2023-50847 | Welcart e-Commerce [usc-e-shop] < 2.9.4 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 7,6 | < 2.9.4 | 2.9.4 | 2023-12-21 | — |
| CVE-2023-6120 | Welcart e-Commerce [usc-e-shop] < 2.9.7 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Baja 2,7 | < 2.9.7 | 2.9.7 | 2023-12-08 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.6 | — | Desconocido | < 2.9.6 | 2.9.6 | 2023-11-15 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.6 | — | Desconocido | < 2.9.6 | 2.9.6 | 2023-11-15 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.5 | — | Desconocido | < 2.9.5 | 2.9.5 | 2023-11-14 | — |
| CVE-2023-5953 | Welcart e-Commerce [usc-e-shop] < 2.9.5 | Falsificación de petición en sitios cruzados (CSRF) | Alta 8,8 | < 2.9.5 | 2.9.5 | 2023-11-14 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.5 | — | Desconocido | < 2.9.5 | 2.9.5 | 2023-11-14 | — |
| CVE-2023-5952 | Welcart e-Commerce [usc-e-shop] < 2.9.5 | Deserialización de datos no confiables | Crítica 9,8 | < 2.9.5 | 2.9.5 | 2023-11-10 | — |
| CVE-2023-5951 | Welcart e-Commerce [usc-e-shop] < 2.9.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.9.5 | 2.9.5 | 2023-11-10 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.8.22 | — | Desconocido | < 2.8.22 | 2.8.22 | 2023-09-15 | — |
| CVE-2023-43493 | Welcart e-Commerce [usc-e-shop] < 2.8.22 | — | Desconocido | < 2.8.22 | 2.8.22 | 2023-09-14 | — |
| CVE-2023-40219 | Welcart e-Commerce [usc-e-shop] >= 2.7 - <= 2.8.21 | Carga de archivos sin restricción de tipo peligroso | Alta 7,2 | 2.7–2.8.22 | 2.8.22 | 2023-09-14 | — |
| CVE-2023-22705 | Welcart e-Commerce [usc-e-shop] < 2.8.11 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 2.8.11 | 2.8.11 | 2023-01-27 | — |
| CVE-2022-4655 | Welcart e-Commerce [usc-e-shop] < 2.8.9 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.8.9 | 2.8.9 | 2022-12-23 | — |
| CVE-2022-4237 | Welcart e-Commerce [usc-e-shop] < 2.8.6 | Deserialización de datos no confiables | Alta 8,8 | < 2.8.6 | 2.8.6 | 2022-12-05 | — |
| CVE-2022-4236 | Welcart e-Commerce [usc-e-shop] < 2.8.5 | Archivos o directorios accesibles a terceros | Media 6,5 | < 2.8.5 | 2.8.5 | 2022-12-05 | — |
| CVE-2022-4140 | Welcart e-Commerce [usc-e-shop] < 2.8.5 | Archivos o directorios accesibles a terceros | Alta 7,5 | < 2.8.5 | 2.8.5 | 2022-11-30 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.8.4 | — | Desconocido | < 2.8.4 | 2.8.4 | 2022-11-28 | — |
| CVE-2022-3946 | Welcart e-Commerce [usc-e-shop] < 2.8.4 | Falsificación de petición en sitios cruzados (CSRF) | Media 6,5 | < 2.8.4 | 2.8.4 | 2022-11-21 | — |
| CVE-2022-3935 | Welcart e-Commerce [usc-e-shop] < 2.8.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.8.4 | 2.8.4 | 2022-11-21 | — |
| CVE-2022-41840 | Welcart e-Commerce [usc-e-shop] < 2.7.8 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Alta 7,5 | < 2.7.8 | 2.7.8 | 2022-09-02 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Desconocido | < 2.2.8 | 2.2.8 | 2021-08-06 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Desconocido | < 2.2.8 | 2.2.8 | 2021-08-06 | — |
| CVE-2021-4355, CVE-2021-4375 | Welcart e-Commerce [usc-e-shop] < 2.2.8 | Falta de control de autorización | Media 5,3 | < 2.2.8 | 2.2.8 | 2021-08-06 | — |
| CVE-2021-20734 | Welcart e-Commerce [usc-e-shop] < 2.2.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.2.4 | 2.2.4 | 2021-06-11 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.0.1 | — | Desconocido | < 2.0.1 | 2.0.1 | 2021-02-09 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.1.1 | — | Desconocido | < 2.1.1 | 2.1.1 | 2021-02-08 | — |
| CVE-2020-28339 | Welcart e-Commerce [usc-e-shop] < 1.9.36 | Deserialización de datos no confiables | Alta 8,8 | < 1.9.36 | 1.9.36 | 2020-11-05 | — |
| CVE-2016-4826 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 1.8.3 | 1.8.3 | 2016-06-24 | — |
| CVE-2016-4825 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | Validación incorrecta de la entrada | Media 5,6 | < 1.8.3 | 1.8.3 | 2016-05-17 | — |
| CVE-2016-4828 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | — | Media 6,5 | < 1.8.3 | 1.8.3 | 2016-05-17 | — |
| CVE-2016-4827 | Welcart e-Commerce [usc-e-shop] < 1.8.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 1.8.3 | 1.8.3 | 2016-05-17 | — |
| CVE-2015-7791 | Welcart e-Commerce [usc-e-shop] < 1.5.3 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Media 6,3 | < 1.5.3 | 1.5.3 | 2015-10-09 | — |
| — | Welcart e-Commerce [usc-e-shop] < 1.1 | — | Desconocido | < 1.1 | 1.1 | 2015-07-25 | — |
| CVE-2015-2973 | Welcart e-Commerce [usc-e-shop] < 1.4.18 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 1.4.18 | 1.4.18 | 2015-04-07 | — |
| CVE-2014-10017 | Welcart e-Commerce [usc-e-shop] < 1.5 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Desconocido | < 1.5 | 1.5 | 2014-03-04 | — |
| CVE-2014-10016 | Welcart e-Commerce [usc-e-shop] < 1.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 1.5 | 1.5 | 2014-03-03 | — |
| CVE-2012-5177 | Welcart e-Commerce [usc-e-shop] < 1.2.2 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 1.2.2 | 1.2.2 | 2012-09-26 | — |
| CVE-2012-5178 | Welcart e-Commerce [usc-e-shop] < 1.2.2 | Falsificación de petición en sitios cruzados (CSRF) | Desconocido | < 1.2.2 | 1.2.2 | 2012-09-26 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.11.10 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.11.10 | 2.11.10 | 0000-00-00 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.11.21 | — | Desconocido | < 2.11.21 | 2.11.21 | 0000-00-00 | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Desconocido | < 2.2.8 | 2.2.8 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.2.8 | — | Desconocido | < 2.2.8 | 2.2.8 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.1.1 | — | Desconocido | < 2.1.1 | 2.1.1 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 1.8.3 | — | Desconocido | < 1.8.3 | 1.8.3 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 1.5 | — | Desconocido | < 1.5 | 1.5 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.5 | — | Desconocido | < 2.9.5 | 2.9.5 | — | — |
| — | Welcart e-Commerce [usc-e-shop] < 2.9.6 | — | Desconocido | < 2.9.6 | 2.9.6 | — | — |
| — | Welcart e-Commerce 1.3.12 - DOM Cross-Site Scripting (XSS) | — | Desconocido | < 1.5 | 1.5 | — | — |
| — | Welcart e-Commerce < 1.8.3 - Session Management | — | Desconocido | < 1.8.3 | 1.8.3 | — | — |
| — | Welcart e-Commerce < 2.1.1 - Authenticated SQL Injection | — | Desconocido | < 2.1.1 | 2.1.1 | — | — |
| CVE-2021-20734 | Welcart e-Commerce < 2.2.4 - Cross-Site Scripting (XSS) | — | Desconocido | < 2.2.4 | 2.2.4 | — | — |
| CVE-2021-4355 | Welcart e-Commerce < 2.2.8 - Unauthenticated Information Disclosure | — | Desconocido | < 2.2.8 | 2.2.8 | — | — |
| CVE-2021-4375 | Welcart e-Commerce < 2.2.8 - Authenticated System Information Disclosure | — | Desconocido | < 2.2.8 | 2.2.8 | — | — |
| CVE-2023-43610 | Welcart e-Commerce < 2.8.22 - Editor+ SQL Injection | — | Desconocido | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-43493 | Welcart e-Commerce < 2.8.22 - Author+ SQL Injection | — | Desconocido | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-41233, CVE-2023-41962, CVE-2023-43484, CVE-2023-43614 | Welcart e-Commerce < 2.8.22 - Multiple XSS | — | Desconocido | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-40532 | Welcart e-Commerce < 2.8.22 - Author+ Path Traversal | — | Desconocido | < 2.8.22 | 2.8.22 | — | — |
| CVE-2023-5953 | Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload | — | Desconocido | < 2.9.5 | 2.9.5 | — | — |
| — | Welcart e-Commerce < 2.9.5 - Cross-Site Request Forgery | — | Desconocido | < 2.9.5 | 2.9.5 | — | — |
| — | Welcart e-Commerce < 2.9.6 - Admin+ PHP Object Injection | — | Desconocido | < 2.9.6 | 2.9.6 | — | — |
| CVE-2025-0511 | Welcart e-Commerce < 2.11.10 - Unauthenticated Stored Cross-Site Scripting via name Parameter | — | Desconocido | < 2.11.10 | 2.11.10 | — | — |
| CVE-2025-9367 | Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting | — | Desconocido | < 2.11.21 | 2.11.21 | — | — |
Cómo solucionarlo
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Alternativas más seguras / más establecidas
- Menu Cart for WooCommerce — 70000+ instalaciones activas — 92/100 (99) — PHP máx. 8.4
- WCBoost – Wishlist — 40000+ instalaciones activas — PHP máx. 8.4
- Klarna for WooCommerce — 20000+ instalaciones activas — 46/100 (20) — PHP máx. 8.4
- Ecwid by Lightspeed Ecommerce Shopping Cart — 20000+ instalaciones activas — 90/100 (228) — PHP máx. 8.4
- Conversion Tracking for WooCommerce — 20000+ instalaciones activas — 60/100 (24)
Verifica tu propio sitio WordPress
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.