Plugin Pulse Beta
← Pulse

Welcart e-Commerce

by info@welcart · eCommerce

Also makes 2 other plugins · 10K+ installs across the portfolio →

Try it live ↗ wp.org ↗

Welcart is a free WordPress e-commerce plugin with the top market share in Japan.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

⚠ Few reviews

Health

B 83/100

Few reviews

Active installs

10K+

≈19K estimated

Momentum

+1%

downloads vs prior 30d

Biggest opportunity: Swap “cart”, “shopping” and “store” for “japan”, “online shop” and “market”. “cart” isn't earning its slot: you're not in the first 24 results for its own search. “japan” sits at #4 untagged, close enough for a declared tag to move it up. “shopping” isn't earning its slot: you're not in the first 24 results for its own search. “online shop” sits at #15 untagged, close enough for a declared tag to move it up. “store” isn't earning its slot: you're not in the first 24 results for its own search. “market” sits at #20 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.

See the detail → Get the free audit
How scoring works →
83 Health · B
Maintenance 100/100
Rating quality 78/100
Support 70/100
Security 75/100

83 health vs 71 average across 9,751 eCommerce plugins

10K+

Active installs

≈19K estimated

1.4M

Total downloads

since 2009 · 0.7% still active

4.1/5

Rating

4.5 on wp.org · 6 reviews

+1%

16.2K

Downloads · 30d

category median +10%

Install conversion

How it's measured →

0.7%

of downloads still active

At least 10K of 1.4M lifetime downloads are still running, below its category: the median eCommerce plugin keeps 1.4%, across 5,143 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other eCommerce plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 18 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 6 reviews

Read on wp.org ↗
5★
4 4★
1 3★
1 2★
0 1★
0

Details

Version
2.12.6
Last updated
8d ago
Added
2009-10-23 · 17 yrs old
Requires WP
5.6
Tested up to
7.1.4
Requires PHP
7.4
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

90 / 100

Excellent listing optimization

Most to gain: Rating quality

Update recency 100/100

Updated 8 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 58/100

4.5★ over 6 reviews, smoothed to 4.14★ and held back under 25 reviews

Listing tuning 100/100

5 of 5 tags set · short description in place

To rank higher: Too few reviews to rank on quality — nudge happy users to leave one.

Get the full rank-higher report →

Daily downloads

Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive

+1% vs prior 30d
22531 Oct 2026

30-day downloads

Rolling 30-day volume · peak 32.4K · peaks are release surges

16.2K31 Oct 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Welcart e-Commerce · #1464youCargus · #7671Shipping by Machool · #15613External Product New · #3758

Rating trend

Star average over time · dips mark rough releases

4.531 Oct 2026

Health trend

Composite health score, snapshotted daily

8331 Oct 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

1.6K31 Oct 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

18

releases in the last 12 months

8d ago

latest release · v2.12.6 · 23 Oct 2026

294

tagged releases on record

Recent releases

2.12.6 · 23 Oct 20262.12.5 · 13 Oct 20262.11.36 · 24 Sep 20262.12.4 · 17 Sep 20262.12.3 · 11 Sep 20262.11.35 · 8 Sep 20262.12.2 · 31 Aug 20262.12.1 · 18 Aug 20262.11.34 · 17 Aug 20262.11.33 · 5 Aug 20262.11.32 · 30 Jul 20262.11.31 · 2 Jul 20262.11.30 · 30 Jun 20262.11.29 · 3 Jun 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v2.11 46%
v1.9 15%
v2.8 11%
v2.9 5.6%
Older / other versions 22%

Estimated active installs

The public count shows “10K+”. Our estimate pins where the real number sits.

tracked estimate
10K–20K ≈19K

Crossed into this band 7 months ago and the previous band took 6.3 years to cross, so the real count is still just under 20K.

Install history since 8 Nov 2020

10K31 Oct 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ matthew1309
    1.1y ago

    コンビニ決済に対応した決済サービスを導入しやすい点で、WooCommerceより便利。ただし、WooCommerceのような分かりやすい説明はないため、慣れが必要。 以下の点で分かりづらく、仕組みを理解するのに時間がかかった。・最初に商品の新規追加をしようとしても、配送方法を登録しておかないとエラーとなり、配送方法の登録からやり直すことになる。・設定欄によって文字を入力するだけでよいものと、文字の入力後に追加ボタンを押す必要があるものがある（追加ボタンが入力欄を追加するボタンに見えるが、実際は確定ボタン相当となっている）ため、統一性がなく非常に分かりづらい。 また、プラグインを有効化した瞬間に固定ページと投稿カテゴリーを勝手に作り、無効化してもそれらが残ってしまうという、一度でも有効化すると環境を汚してしまうところも美しくない。そのため、既存の環境に安易に有効化せず、テスト用の環境で使ってみるのがお勧め。 （訂正）カスタム投稿タイプは追加しない様子のため訂正した。SKUも商品の新規追加時に設定可能だったため、配送方法だけ事前に登録しておけば、商品の新規追加が可能だった。 This topic was modified 10 months ago by matthew1309. This topic was modified 10 months ago by matthew1309.

    Read on wp.org ↗
  2. ★★★★★ 阿部
    2.6y ago

    無料とは思えない高機能カートシステム。 設定が簡単です。 カスタマイズの幅も広いです。 他のプラグインと併用して機能拡張できるのも便利です。

    Read on wp.org ↗
  3. ★★★★★ Hasan Islom
    4.2y ago

    オンラインショップを無料で制作するにすごくいいプラグインです。 カスタマーサポートも日本語で優しくしてくれて助かります。

    Read on wp.org ↗
  4. ★★★★★ Mizuho Ogino
    11.8y ago

    It is a highly customizable plugin package. Their support also is very good and really helped for me.

    Read on wp.org ↗
  5. ★★★★★ Carolrosent
    12.1y ago

    Really good plugin , fairly simple to use

    Read on wp.org ↗
  6. ★★★★★ Jandal
    14.0y ago

    We are using this for a Japan e-commerce website, it is pretty good once you get into it. There are a number of things that really do need updating though, we have had to heavily modify the plugin core. Generally it is doing the job and has good integration into payment gateways for Japan. When it comes to translation, as we have a bi-lingual website, it is missing translation support in a number of areas, but we have been able to make it work. You will need PHP and WordPress experience to make the most of this plugin. =-)

    Read on wp.org ↗

Latest updates

via wp.org changelog

Recent releases and news for this plugin

  1. — Version 11.31 [e-SCOTT / WelcartPay] Fixed a bug that caused an error with the product name in online payment collection transactions. Fixed a bug in the filtering of the “Order List CSV” and “Order Details List CSV” exported from the 11.31
  2. — Version 11.30 [Zeus] Updated the mobile phone number validation for Buy Now Pay Later payment. [Paidy] Fixed parameters. Updated the Japan Post tracking URL. Changed the order list and member list downloads in the admin screen to allo 11.30
  3. — Version 11.29 Security enhancement (Broken Access Control). [PayPal] Fixed subsequent processing after payment error in automatic recurring billing. Fixed a bug where radio buttons and checkboxes were not displayed in button_to_cart. 11.29
  4. — Version 11.28 [PayPal] Removed unnecessary IPN settings. [PayPal] Fixed a bug that an error status was not displayed on the order list when a capture error occurred. Fixed the style of the “Close” button on the mail sending dialog. Ad 11.28
  5. — Version 11.27 Made compatible with PHP 8.3. [WelcartPay] Fixed a bug that error messages for credit card updates were not displayed on the My Page when using 3DS. Fixed a bug that members using recurring payments could cancel their me 11.27
  6. — Version 11.26 Fixed a bug that the quantity could not be updated on the cart page when the SKU code contained specific symbols. Fixed a bug that an error occurred when attempting to use points for shipping payment when purchasing a 0 11.26

Security history

via Wordfence Intelligence

All 63 disclosed vulnerabilities are patched in the current version (2.12.6). Sites still on an older version should update.

  1. Patched Medium · 5.3 Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter ↗
    2026-10-30 CVE-2026-119166 Improper Authentication Affects <= 2.12.5 Patched in 2.12.6
  2. Patched High · 7.2 Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter ↗
    2026-10-30 CVE-2026-118070 Improper Neutralization of Input During Web Page Generation Affects <= 2.12.5 Patched in 2.12.6
  3. Patched Medium · 4.9 Welcart e-Commerce < 2.12.6 - Authenticated (Editor+) SQL Injection ↗
    2026-10-28 CVE-2026-111027 Improper Neutralization of Special Elements used in an SQL Command Affects < 2.12.6 Patched in 2.12.6
  4. Patched Medium · 4.3 Welcart e-Commerce < 2.12.6 - Missing Authorization ↗
    2026-10-28 CVE-2026-111032 Missing Authorization Affects < 2.12.6 Patched in 2.12.6
  5. Patched Medium · 4.7 Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect ↗
    2026-10-26 CVE-2026-111031 URL Redirection to Untrusted Site Affects < 2.12.6 Patched in 2.12.6
  6. Patched Medium · 4.9 Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie ↗
    2026-10-16 CVE-2026-107752 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.12.4 Patched in 2.12.5
  7. Patched High · 7.2 Welcart e-Commerce <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-10-03 CVE-2026-96761 Improper Neutralization of Input During Web Page Generation Affects <= 2.12.3 Patched in 2.12.4
  8. Patched High · 7.2 Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters ↗
    2026-10-02 CVE-2026-87091 Improper Neutralization of Input During Web Page Generation Affects <= 2.12.2 Patched in 2.12.3
  9. Patched High · 8.8 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback ↗
    2026-09-04 CVE-2026-19887 Deserialization of Untrusted Data Affects <= 2.12.1 Patched in 2.12.2
  10. Patched High · 7.2 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter ↗
    2026-08-31 CVE-2026-19914 Improper Neutralization of Input During Web Page Generation Affects <= 2.12.1 Patched in 2.12.2
  11. Patched Medium · 6.5 Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation ↗
    2026-08-19 CVE-2025-15671 Improper Authentication Affects < 2.12.1 Patched in 2.12.1
  12. Patched Medium · 5.3 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass ↗
    2026-08-14 CVE-2026-15213 Client-Side Enforcement of Server-Side Security Affects < 2.11.33 Patched in 2.11.33
  13. Patched High · 7.2 Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-08-11 CVE-2026-27539 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.31 Patched in 2.11.32
  14. Patched Medium · 6.4 Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting ↗
    2026-08-10 CVE-2026-16066 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.33 Patched in 2.11.34
  15. Patched Medium · 4.9 Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection ↗
    2026-07-31 CVE-2026-16065 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.11.31 Patched in 2.11.32
  16. Patched Medium · 5.3 Welcart e-Commerce <= 2.11.28 - Missing Authorization ↗
    2026-06-04 CVE-2026-49775 Missing Authorization Affects <= 2.11.28 Patched in 2.11.29
  17. Patched Medium · 5.3 Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure ↗
    2025-11-12 CVE-2025-12979 Missing Authorization Affects <= 2.11.24 Patched in 2.11.25
  18. Patched Medium · 5.5 Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail ↗
    2025-10-21 CVE-2025-10651 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.22 Patched in 2.11.23
  19. Patched Medium · 4.3 Welcart e-Commerce <= 2.11.24 - Missing Authorization ↗
    2025-10-14 CVE-2025-62953 Missing Authorization Affects <= 2.11.24 Patched in 2.11.25
  20. Patched Medium · 6.5 Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie ↗
    2025-10-07 CVE-2025-10649 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.11.21 Patched in 2.11.22
  21. Patched Medium · 5.5 Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2025-09-09 CVE-2025-9367 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.20 Patched in 2.11.21
  22. Patched Medium · 4.4 Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2025-09-09 CVE-2025-58984 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.20 Patched in 2.11.21
  23. Patched Medium · 6.6 Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection ↗
    2025-08-12 CVE-2025-54012 Deserialization of Untrusted Data Affects <= 2.11.16 Patched in 2.11.17
  24. Patched Medium · 5.5 Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2025-07-16 CVE-2025-54013 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.16 Patched in 2.11.17
  25. Patched Medium · 6.5 Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion ↗
    2025-06-03 CVE-2025-47511 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.11.13 Patched in 2.11.14
  26. Patched High · 7.2 Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter ↗
    2025-02-11 CVE-2025-0511 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.9 Patched in 2.11.10
  27. Patched Medium · 4.9 Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection ↗
    2024-09-18 CVE-2024-42404 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.11.1 Patched in 2.11.2
  28. Patched Medium · 5.4 Welcart e-Commerce <= 2.9.14 - Missing Authorization ↗
    2024-04-12 CVE-2024-32144 Missing Authorization Affects <= 2.9.14 Patched in 2.10.0
  29. Patched High · 7.2 Welcart e-Commerce <= 2.9.3 - Authenticated(Editor+) SQL Injection ↗
    2023-12-21 CVE-2023-50847 Improper Neutralization of Special Elements used in an SQL Command Affects < 2.9.4 Patched in 2.9.4
  30. Patched Medium · 4.1 Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal ↗
    2023-12-08 CVE-2023-6120 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.9.6 Patched in 2.9.7
  31. Patched High · 7.2 Welcart e-Commerce <= 2.9.5 - Authenticated (Administrator+) PHP Object Injection ↗
    2023-11-15 Deserialization of Untrusted Data Affects < 2.9.6 Patched in 2.9.6
  32. Patched High · 8.8 Welcart e-Commerce <= 2.9.4 - Cross-Site Request Forgery ↗
    2023-11-14 Cross-Site Request Forgery Affects <= 2.9.4 Patched in 2.9.5
  33. Patched High · 8.8 Welcart e-Commerce <= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2023-11-14 CVE-2023-5953 Unrestricted Upload of File with Dangerous Type Affects <= 2.9.4 Patched in 2.9.5
  34. Patched Medium · 6.1 Welcart e-Commerce <= 2.9.4 - Reflected Cross-Site Scripting ↗
    2023-11-10 CVE-2023-5951 Improper Neutralization of Input During Web Page Generation Affects <= 2.9.4 Patched in 2.9.5
  35. Patched Critical · 9.8 Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection ↗
    2023-11-10 CVE-2023-5952 Deserialization of Untrusted Data Affects <= 2.9.4 Patched in 2.9.5
  36. Patched High · 8.8 Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload ↗
    2023-09-26 CVE-2023-40219 Unrestricted Upload of File with Dangerous Type Affects <= 2.8.21 Patched in 2.8.22
  37. Patched High · 8.8 Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs ↗
    2023-09-14 CVE-2023-43493 Improper Neutralization of Special Elements used in an SQL Command Affects < 2.8.22 Patched in 2.8.22
  38. Patched High · 8.8 Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection ↗
    2023-09-14 CVE-2023-43610 Improper Neutralization of Special Elements used in an SQL Command Affects < 2.8.22 Patched in 2.8.22
  39. Patched High · 7.2 Welcart e-Commerce <= 2.8.10 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-01-27 CVE-2023-22705 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.10 Patched in 2.8.11
  40. Patched Medium · 6.4 Welcart e-Commerce <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2022-12-23 CVE-2022-4655 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.8 Patched in 2.8.9
  41. Patched Medium · 6.5 Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization ↗
    2022-12-05 CVE-2022-4237 Deserialization of Untrusted Data Affects <= 2.8.5 Patched in 2.8.6
  42. Patched Medium · 6.5 Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read ↗
    2022-12-05 CVE-2022-4236 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.8.4 Patched in 2.8.5
  43. Patched High · 7.5 Welcart e-Commerce 2.6.10-2.8.4 - Information Disclosure via Arbitrary File Read ↗
    2022-11-30 CVE-2022-4140 Exposure of Sensitive Information to an Unauthorized Actor Affects 2.6.10 - 2.8.4 Patched in 2.8.5
  44. Patched High · 8.8 Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery ↗
    2022-11-28 Cross-Site Request Forgery Affects <= 2.8.3 Patched in 2.8.4
  45. Patched Medium · 6.4 Welcart e-Commerce <= 2.8.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2022-11-21 CVE-2022-3935 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.3 Patched in 2.8.4
  46. Patched Medium · 5.4 Welcart e-Commerce <= 2.8.3 - Missing Authorization ↗
    2022-11-21 CVE-2022-3946 Missing Authorization Affects <= 2.8.3 Patched in 2.8.4
  47. Patched High · 8.8 Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery ↗
    2022-11-16 Cross-Site Request Forgery Affects <= 2.8.3 Patched in 2.8.4
  48. Patched High · 7.5 Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read ↗
    2022-09-02 CVE-2022-41840 Exposure of Sensitive Information to an Unauthorized Actor Affects 2.6.0 - 2.7.7 Patched in 2.7.8
  49. Patched High · 7.5 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure ↗
    2021-08-06 CVE-2021-4355 Missing Authorization Affects < 2.2.8 Patched in 2.2.8
  50. Patched Medium · 4.3 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure ↗
    2021-08-06 CVE-2021-4375 Missing Authorization Affects < 2.2.8 Patched in 2.2.8
  51. Patched Medium · 6.1 Welcart e-Commerce <= 2.2.3 - Reflected Cross-Site Scripting ↗
    2021-06-11 CVE-2021-20734 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.3 Patched in 2.2.4
  52. Patched High · 8.8 Welcart e-Commerce <= 2.1.0 - SQL Injection ↗
    2021-02-08 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.1.0 Patched in 2.1.1
  53. Patched High · 7.5 Welcart e-Commerce <= 1.9.35 - PHP Object Injection ↗
    2020-11-05 CVE-2020-28339 Deserialization of Untrusted Data Affects < 1.9.36 Patched in 1.9.36
  54. Patched Medium · 6.1 Welcart e-Commerce <= 1.8.2 - Cross-Site Scripting ↗
    2016-06-24 CVE-2016-4827 Improper Neutralization of Input During Web Page Generation Affects <= 1.8.2 Patched in 1.8.3
  55. Patched Critical · 9.8 Welcart e-Commerce <= 1.8.2 - Authentication Bypass ↗
    2016-06-24 CVE-2016-4828 Authentication Bypass Using an Alternate Path or Channel Affects <= 1.8.2 Patched in 1.8.3
  56. Patched High · 8.1 Welcart e-Commerce < 1.8.3 - Object Injection ↗
    2016-06-24 CVE-2016-4825 Deserialization of Untrusted Data Affects < 1.8.3 Patched in 1.8.3
  57. Patched Medium · 6.1 Welcart e-Commerce < 1.8.3 - Reflected Cross-Site Scripting ↗
    2016-06-24 CVE-2016-4826 Improper Neutralization of Input During Web Page Generation Affects < 1.8.3 Patched in 1.8.3
  58. Patched High · 8.8 Welcart e-Commerce < 1.5.3 - SQL Injection ↗
    2015-12-17 CVE-2015-7791 Improper Neutralization of Special Elements used in an SQL Command Affects < 1.5.3 Patched in 1.5.3
  59. Patched High · 7.1 Welcart e-Commerce < 1.4.18 - Multiple Cross-Site Scripting ↗
    2015-07-15 CVE-2015-2973 Improper Neutralization of Input During Web Page Generation Affects < 1.4.18 Patched in 1.4.18
  60. Patched Critical · 9.8 Welcart e-Commerce <= 2.9.1 - SQL Injection ↗
    2014-03-04 CVE-2014-10017 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.9.1 Patched in 2.9.2
  61. Patched Medium · 6.1 Welcart e-Commerce <= 2.11.1 - Cross-Site Scripting ↗
    2014-03-03 CVE-2014-10016 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.1 Patched in 2.11.2
  62. Patched Medium · 6.1 Welcart e-Commerce < 1.2.2 - Cross-Site Scripting ↗
    2012-12-14 CVE-2012-5177 Improper Neutralization of Input During Web Page Generation Affects < 1.2.2 Patched in 1.2.2
  63. Patched High · 8.8 Welcart e-Commerce < 1.2.2 - Cross-Site Request Forgery ↗
    2012-12-14 CVE-2012-5178 Cross-Site Request Forgery Affects < 1.2.2 Patched in 1.2.2

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Behavioral tests

via WP Hive

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

✓ Low memory footprint
✓ Low page-speed impact
✓ Runs on latest PHP + WP
✓ No PHP errors
✓ No JS errors
✓ Activates cleanly
✓ No resource errors
✓ No external HTTP errors
✓ Optimized database use
✓ Frequently updated

Languages

via translate.wordpress.org

Translated into 53 languages, 1 at 90% or more

Japanese 100%
Vietnamese 67%
Thai 31%
English (Australia) 29%
Swedish 28%
Russian 17%
Ukrainian 17%
German 9%
Danish 7%
English (Canada) 7%
Romanian 7%
Cebuano 6%
Dutch (Formal) 6%
English (South Africa) 6%
English (UK) 6%
French (France) 6%
Azerbaijani 5%
Dutch 5%
English (New Zealand) 5%
Czech 4%
Italian 4%
Moroccan Arabic 4%
Polish 4%
Finnish 3%

Plus 29 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Readme readiness

2 of 8 pass · checked 25 Oct 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ! Says what it does Short description names no action; say what the plugin does for the site.
  • ! Has a FAQ Only 1 question in the FAQ; 3 or more gives an assistant something to match.
  • ! FAQ asks real questions 0 of 1 FAQ entries are headings, not questions ("undefined").
  • ! Names who it is for Never says who the plugin is for or what they use it for.
  • ! Names what it works with Names no plugin, service or platform it works with.
  • ! Headings and lists 4 headings and 0 lists; assistants quote headed sections and bullet lists, not paragraphs.
  • ✓ Enough to quote 1,310 characters of description.
  • ✓ Tags match the text All 5 tags appear in the text.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2026-03-22 20K+ → 10K+ down after 2314 days in tier
  2. 2019-11-20 10K+ → 20K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Welcart e-Commerce into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/usc-e-shop" width="480" height="300" style="border:0" loading="lazy" title="Welcart e-Commerce — Plugin Pulse"></iframe>
Preview card ↗

Welcart e-Commerce: 10K+ active installs, 4.5★ (6 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/usc-e-shop

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.