Vulnerability record · CVE-2015-2973 · published 24 July 2015

CVE-2015-2973: Welcart e-commerce cross-site scripting vulnerability

Welcart · Welcart E Commerce

Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.

4.3 CVSS 2.0 Medium EPSS 2.0% · top 19.3% CWE-79 · Cross-site scripting

4.3CVSS 2.0 base score

2.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References

17 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Welcart E Commerce Welcart

References

Link	Tags
http://jvn.jp/en/jp/JVN97971874/index.html	Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000103	Vendor Advisory
http://www.welcart.com/community/archives/74867	PatchVendor Advisory
https://plugins.trac.wordpress.org/changeset/1199120
https://wpvulndb.com/vulnerabilities/8114
http://jvn.jp/en/jp/JVN97971874/index.html	Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000103	Vendor Advisory
http://www.welcart.com/community/archives/74867	PatchVendor Advisory
https://plugins.trac.wordpress.org/changeset/1199120
https://wpvulndb.com/vulnerabilities/8114

Track CVE-2015-2973 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-5952Welcart e-commerce vulnerabilityThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Obj…EPSS 1.3%4 Dec 2023 9.8CVE-2022-41840Welcart e-commerce path traversal vulnerabilityUnauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.EPSS 5.5%18 Nov 2022 8.8CVE-2025-27130Welcart e-commerce deserialization of untrusted data vulnerabilityWelcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrar…EPSS 0.46%1 Apr 2025 8.8CVE-2024-42404Welcart e-commerce sql injection vulnerabilitySQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information …EPSS 0.48%18 Sep 2024 8.8CVE-2023-5953Welcart e-commerce unrestricted file upload vulnerabilityThe Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJ…EPSS 0.48%4 Dec 2023 8.8CVE-2023-43610Welcart e-commerce sql injection vulnerabilitySQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority…EPSS 1.2%27 Sep 2023 8.8CVE-2022-4237Welcart e-commerce vulnerabilityThe Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions …EPSS 1.1%2 Jan 2023 8.8CVE-2020-28339Welcart e-commerce deserialization of untrusted data vulnerabilityThe usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not …EPSS 1.9%7 Nov 2020

Source: NIST National Vulnerability Database (record CVE-2015-2973), CISA KEV, FIRST EPSS (scores of 2026-10-16). This page is refreshed as NVD updates the record.