Welcart e-Commerce

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ matthew1309

   12mo ago

   コンビニ決済に対応した決済サービスを導入しやすい点で、WooCommerceより便利。ただし、WooCommerceのような分かりやすい説明はないため、慣れが必要。 以下の点で分かりづらく、仕組みを理解するのに時間がかかった。・最初に商品の新規追加をしようとしても、配送方法を登録しておかないとエラーとなり、配送方法の登録からやり直すことになる。・設定欄によって文字を入力するだけでよいものと、文字の入力後に追加ボタンを押す必要があるものがある（追加ボタンが入力欄を追加するボタンに見えるが、実際は確定ボタン相当となっている）ため、統一性がなく非常に分かりづらい。 また、プラグインを有効化した瞬間に固定ページと投稿カテゴリーを勝手に作り、無効化してもそれらが残ってしまうという、一度でも有効化すると環境を汚してしまうところも美しくない。そのため、既存の環境に安易に有効化せず、テスト用の環境で使ってみるのがお勧め。 （訂正）カスタム投稿タイプは追加しない様子のため訂正した。SKUも商品の新規追加時に設定可能だったため、配送方法だけ事前に登録しておけば、商品の新規追加が可能だった。 This topic was modified 10 months ago by matthew1309. This topic was modified 10 months ago by matthew1309.

   Read on wp.org ↗
2. ★★★★★ 阿部

   2.5y ago

   無料とは思えない高機能カートシステム。 設定が簡単です。 カスタマイズの幅も広いです。 他のプラグインと併用して機能拡張できるのも便利です。

   Read on wp.org ↗
3. ★★★★★ Hasan Islom

   4.0y ago

   オンラインショップを無料で制作するにすごくいいプラグインです。 カスタマーサポートも日本語で優しくしてくれて助かります。

   Read on wp.org ↗
4. ★★★★★ Mizuho Ogino

   11.6y ago

   It is a highly customizable plugin package. Their support also is very good and really helped for me.

   Read on wp.org ↗
5. ★★★★★ Carolrosent

   11.9y ago

   Really good plugin , fairly simple to use

   Read on wp.org ↗
6. ★★★★★ Jandal

   13.8y ago

   We are using this for a Japan e-commerce website, it is pretty good once you get into it. There are a number of things that really do need updating though, we have had to heavily modify the plugin core. Generally it is doing the job and has good integration into payment gateways for Japan. When it comes to translation, as we have a bi-lingual website, it is missing translation support in a number of areas, but we have been able to make it work. You will need PHP and WordPress experience to make the most of this plugin. =-)

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 11.31 [e-SCOTT / WelcartPay] Fixed a bug that caused an error with the product name in online payment collection transactions. Fixed a bug in the filtering of the “Order List CSV” and “Order Details List CSV” exported from the 11.31
2. — Version 11.30 [Zeus] Updated the mobile phone number validation for Buy Now Pay Later payment. [Paidy] Fixed parameters. Updated the Japan Post tracking URL. Changed the order list and member list downloads in the admin screen to allo 11.30
3. — Version 11.29 Security enhancement (Broken Access Control). [PayPal] Fixed subsequent processing after payment error in automatic recurring billing. Fixed a bug where radio buttons and checkboxes were not displayed in button_to_cart. 11.29
4. — Version 11.28 [PayPal] Removed unnecessary IPN settings. [PayPal] Fixed a bug that an error status was not displayed on the order list when a capture error occurred. Fixed the style of the “Close” button on the mail sending dialog. Ad 11.28
5. — Version 11.27 Made compatible with PHP 8.3. [WelcartPay] Fixed a bug that error messages for credit card updates were not displayed on the My Page when using 3DS. Fixed a bug that members using recurring payments could cancel their me 11.27
6. — Version 11.26 Fixed a bug that the quantity could not be updated on the cart page when the SKU code contained specific symbols. Fixed a bug that an error occurred when attempting to use points for shipping payment when purchasing a 0 11.26

52 disclosed vulnerabilities on record for this plugin, 1 still affects the current version.

1. Medium · 5.3 Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass ↗
   2026-08-14 CVE-2026-15213 Client-Side Enforcement of Server-Side Security Affects < 2.11.33 Patched in 2.11.33
2. High · 7.2 Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-08-11 CVE-2026-27539 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.31 Patched in 2.11.32
3. Medium · 6.4 Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting ↗
   2026-08-10 CVE-2026-16066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.33 Patched in 2.11.34
4. Medium · 4.9 Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection ↗
   2026-07-31 CVE-2026-16065 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.11.31 Patched in 2.11.32
5. Medium · 5.3 Welcart e-Commerce <= 2.11.28 - Missing Authorization ↗
   2026-06-04 CVE-2026-49775 Missing Authorization Affects <= 2.11.28 Patched in 2.11.29
6. Medium · 5.3 Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure ↗
   2025-11-12 CVE-2025-12979 Missing Authorization Affects <= 2.11.24 Patched in 2.11.25
7. Medium · 5.5 Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail ↗
   2025-10-21 CVE-2025-10651 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.22 Patched in 2.11.23
8. Medium · 4.3 Welcart e-Commerce <= 2.11.24 - Missing Authorization ↗
   2025-10-14 CVE-2025-62953 Missing Authorization Affects <= 2.11.24 Patched in 2.11.25
9. Medium · 6.5 Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie ↗
   2025-10-07 CVE-2025-10649 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.11.21 Patched in 2.11.22
10. Medium · 5.5 Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2025-09-09 CVE-2025-9367 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.20 Patched in 2.11.21
11. Medium · 4.4 Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2025-09-09 CVE-2025-58984 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.20 Patched in 2.11.21
12. Medium · 6.6 Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection ↗
    2025-08-12 CVE-2025-54012 Deserialization of Untrusted Data Affects <= 2.11.16 Patched in 2.11.17
13. Medium · 5.5 Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2025-07-16 CVE-2025-54013 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.16 Patched in 2.11.17
14. Medium · 6.5 Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion ↗
    2025-06-03 CVE-2025-47511 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 2.11.13 Patched in 2.11.14
15. High · 7.2 Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter ↗
    2025-02-11 CVE-2025-0511 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.9 Patched in 2.11.10
16. Medium · 4.9 Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection ↗
    2024-09-18 CVE-2024-42404 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.11.1 Patched in 2.11.2
17. Medium · 5.4 Welcart e-Commerce <= 2.9.14 - Missing Authorization ↗
    2024-04-12 CVE-2024-32144 Missing Authorization Affects <= 2.9.14 Patched in 2.10.0
18. High · 7.2 Welcart e-Commerce <= 2.9.3 - Authenticated(Editor+) SQL Injection ↗
    2023-12-21 CVE-2023-50847 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 2.9.4 Patched in 2.9.4
19. Medium · 4.1 Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal ↗
    2023-12-08 CVE-2023-6120 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 2.9.6 Patched in 2.9.7
20. High · 7.2 Welcart e-Commerce <= 2.9.5 - Authenticated (Administrator+) PHP Object Injection ↗
    2023-11-15 Deserialization of Untrusted Data Affects < 2.9.6 Patched in 2.9.6
21. High · 8.8 Welcart e-Commerce <= 2.9.4 - Cross-Site Request Forgery ↗
    2023-11-14 Cross-Site Request Forgery (CSRF) Affects <= 2.9.4 Patched in 2.9.5
22. High · 8.8 Welcart e-Commerce <= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2023-11-14 CVE-2023-5953 Unrestricted Upload of File with Dangerous Type Affects <= 2.9.4 Patched in 2.9.5
23. Medium · 6.1 Welcart e-Commerce <= 2.9.4 - Reflected Cross-Site Scripting ↗
    2023-11-10 CVE-2023-5951 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.9.4 Patched in 2.9.5
24. Critical · 9.8 Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection ↗
    2023-11-10 CVE-2023-5952 Deserialization of Untrusted Data Affects <= 2.9.4 Patched in 2.9.5
25. High · 8.8 Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload ↗
    2023-09-26 CVE-2023-40219 Unrestricted Upload of File with Dangerous Type Affects <= 2.8.21 Patched in 2.8.22
26. High · 8.8 Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs ↗
    2023-09-14 CVE-2023-43493 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 2.8.22 Patched in 2.8.22
27. High · 8.8 Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection ↗
    2023-09-14 CVE-2023-43610 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 2.8.22 Patched in 2.8.22
28. High · 7.2 Welcart e-Commerce <= 2.8.10 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-01-27 CVE-2023-22705 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.10 Patched in 2.8.11
29. Medium · 6.4 Welcart e-Commerce <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2022-12-23 CVE-2022-4655 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.8 Patched in 2.8.9
30. Medium · 6.5 Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization ↗
    2022-12-05 CVE-2022-4237 Deserialization of Untrusted Data Affects <= 2.8.5 Patched in 2.8.6
31. Medium · 6.5 Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read ↗
    2022-12-05 CVE-2022-4236 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.8.4 Patched in 2.8.5
32. High · 7.5 Welcart e-Commerce 2.6.10-2.8.4 - Information Disclosure via Arbitrary File Read ↗
    2022-11-30 CVE-2022-4140 Exposure of Sensitive Information to an Unauthorized Actor Affects 2.6.10 - 2.8.4 Patched in 2.8.5
33. High · 8.8 Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery ↗
    2022-11-28 Cross-Site Request Forgery (CSRF) Affects <= 2.8.3 Patched in 2.8.4
34. Medium · 6.4 Welcart e-Commerce <= 2.8.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2022-11-21 CVE-2022-3935 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.3 Patched in 2.8.4
35. Medium · 5.4 Welcart e-Commerce <= 2.8.3 - Missing Authorization ↗
    2022-11-21 CVE-2022-3946 Missing Authorization Affects <= 2.8.3 Patched in 2.8.4
36. High · 8.8 Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery ↗
    2022-11-16 Cross-Site Request Forgery (CSRF) Affects <= 2.8.3 Patched in 2.8.4
37. High · 7.5 Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read ↗
    2022-09-02 CVE-2022-41840 Exposure of Sensitive Information to an Unauthorized Actor Affects 2.6.0 - 2.7.7 Patched in 2.7.8
38. High · 7.5 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure ↗
    2021-08-06 CVE-2021-4355 Missing Authorization Affects < 2.2.8 Patched in 2.2.8
39. Medium · 4.3 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure ↗
    2021-08-06 CVE-2021-4375 Missing Authorization Affects < 2.2.8 Patched in 2.2.8
40. Medium · 6.1 Welcart e-Commerce <= 2.2.3 - Reflected Cross-Site Scripting ↗
    2021-06-11 CVE-2021-20734 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.3 Patched in 2.2.4
41. High · 8.8 Welcart e-Commerce <= 2.1.0 - SQL Injection ↗
    2021-02-08 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.1.0 Patched in 2.1.1
42. High · 7.5 Welcart e-Commerce <= 1.9.35 - PHP Object Injection ↗
    2020-11-05 CVE-2020-28339 Deserialization of Untrusted Data Affects < 1.9.36 Patched in 1.9.36
43. Medium · 6.1 Welcart e-Commerce <= 1.8.2 - Cross-Site Scripting ↗
    2016-06-24 CVE-2016-4827 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.2 Patched in 1.8.3
44. Critical · 9.8 Welcart e-Commerce <= 1.8.2 - Authentication Bypass ↗
    2016-06-24 CVE-2016-4828 Authentication Bypass Using an Alternate Path or Channel Affects <= 1.8.2 Patched in 1.8.3
45. High · 8.1 Welcart e-Commerce < 1.8.3 - Object Injection ↗
    2016-06-24 CVE-2016-4825 Deserialization of Untrusted Data Affects < 1.8.3 Patched in 1.8.3
46. Medium · 6.1 Welcart e-Commerce < 1.8.3 - Reflected Cross-Site Scripting ↗
    2016-06-24 CVE-2016-4826 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.8.3 Patched in 1.8.3
47. High · 8.8 Welcart e-Commerce < 1.5.3 - SQL Injection ↗
    2015-12-17 CVE-2015-7791 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.5.3 Patched in 1.5.3
48. High · 7.1 Welcart e-Commerce < 1.4.18 - Multiple Cross-Site Scripting ↗
    2015-07-15 CVE-2015-2973 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.4.18 Patched in 1.4.18
49. Critical · 9.8 Welcart e-Commerce <= 2.9.1 - SQL Injection ↗
    2014-03-04 CVE-2014-10017 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.9.1 Patched in 2.9.2
50. Medium · 6.1 Welcart e-Commerce <= 1.3.12 - Cross-Site Scripting ↗
    2014-03-03 CVE-2014-10016 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.12 No patch available
51. Medium · 6.1 Welcart e-Commerce < 1.2.2 - Cross-Site Scripting ↗
    2012-12-14 CVE-2012-5177 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.2.2 Patched in 1.2.2
52. High · 8.8 Welcart e-Commerce < 1.2.2 - Cross-Site Request Forgery ↗
    2012-12-14 CVE-2012-5178 Cross-Site Request Forgery (CSRF) Affects < 1.2.2 Patched in 1.2.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 53 languages, 1 at 90% or more

Plus 29 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-03-22 20K+ → 10K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Cargus 700+ installs · 3.4★ · 3 shared tags B
• Shipping by Machool 100+ installs · 3.6★ · 3 shared tags B
• Shopping Cart & eCommerce Store 3K+ installs · 4.4★ · 2 shared tags A
• External Product New Tab for WooCommerce 3K+ installs · 4.6★ · 2 shared tags A
• Invoice Payment Gateway for WooCommerce 2K+ installs · 4.4★ · 2 shared tags A
• WC Pickup Store 2K+ installs · 4.4★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for Welcart e-Commerce into a readme, a review or a deck. It updates itself.

Welcart e-Commerce: 10K+ active installs, 4.5★ (6 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/usc-e-shop