CVE-2026-16065 — Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with…
Published: 2026-08-06 · CVSS: 6.5 · CVSS 3.1
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7