Welcart e-Commerce

79 Quality Score

Active Installs

18/30

With 10,000 active installs and strong domestic dominance, the 60/30 popularity score reflects solid but globally niche adoption rather than mainstream reach.

Update Freshness

25/25

An update landed on 2026-07-02 and it tested cleanly against WordPress 7.0, so maintenance is clearly excellent at 100/25.

User Rating

14/15

A 90/100 average from 6 ratings is positive but the sample is too small to draw strong conclusions about broad user satisfaction.

Support Health

8/15

Support health scored only 50/15 because there are 0 resolved support threads out of 0 total, leaving no public track record of responsiveness or problem-solving.

WP Compatibility

15/15

Full marks at 100/15: it supports PHP 7.4 and WordPress 5.6 through 7.0, covering a wide range of hosting environments.

Scores higher than 71% of indexed plugins

About

Welcart is a free WordPress e-commerce plugin with the top market share in Japan.

Active Installs 10k+

Rating ★★★★½ 4.5/5

Last Updated 2026-09-24 3:09am GMT

Requires WordPress 5.6+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

55 known vulnerabilities, all patched

3 Critical 23 High 29 Medium

Most recent: September 4, 2026

View details ▸

Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback High

September 4, 2026 Patched in ["2.12.2"] CVE-2026-19887

Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter High

August 31, 2026 Patched in ["2.12.2"] CVE-2026-19914

Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation Medium

August 19, 2026 Patched in ["2.12.1"] CVE-2025-15671

Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass Medium

August 14, 2026 Patched in ["2.11.33"] CVE-2026-15213

Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting High

August 11, 2026 Patched in ["2.11.32"] CVE-2026-27539

Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting Medium

August 10, 2026 Patched in ["2.11.34"] CVE-2026-16066

Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection Medium

July 31, 2026 Patched in ["2.11.32"] CVE-2026-16065

Welcart e-Commerce <= 2.11.28 - Missing Authorization Medium

June 4, 2026 Patched in ["2.11.29"] CVE-2026-49775

Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure Medium

November 12, 2025 Patched in ["2.11.25"] CVE-2025-12979

Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail Medium

October 21, 2025 Patched in ["2.11.23"] CVE-2025-10651

Welcart e-Commerce <= 2.11.24 - Missing Authorization Medium

October 14, 2025 Patched in ["2.11.25"] CVE-2025-62953

Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie Medium

October 7, 2025 Patched in ["2.11.22"] CVE-2025-10649

Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting Medium

September 9, 2025 Patched in ["2.11.21"] CVE-2025-9367

Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting Medium

September 9, 2025 Patched in ["2.11.21"] CVE-2025-58984

Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection Medium

August 12, 2025 Patched in ["2.11.17"] CVE-2025-54012

Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting Medium

July 16, 2025 Patched in ["2.11.17"] CVE-2025-54013

Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion Medium

June 3, 2025 Patched in ["2.11.14"] CVE-2025-47511

Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter High

February 11, 2025 Patched in ["2.11.10"] CVE-2025-0511

Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection Medium

September 18, 2024 Patched in ["2.11.2"] CVE-2024-42404

Welcart e-Commerce <= 2.9.14 - Missing Authorization Medium

April 12, 2024 Patched in ["2.10.0"] CVE-2024-32144

Welcart e-Commerce <= 2.9.3 - Authenticated(Editor+) SQL Injection High

December 21, 2023 Patched in ["2.9.4"] CVE-2023-50847

Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal Medium

December 8, 2023 Patched in ["2.9.7"] CVE-2023-6120

Welcart e-Commerce <= 2.9.5 - Authenticated (Administrator+) PHP Object Injection High

November 15, 2023 Patched in ["2.9.6"]

Welcart e-Commerce <= 2.9.4 - Cross-Site Request Forgery High

November 14, 2023 Patched in ["2.9.5"]

Welcart e-Commerce <= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload High

November 14, 2023 Patched in ["2.9.5"] CVE-2023-5953

Welcart e-Commerce <= 2.9.4 - Reflected Cross-Site Scripting Medium

November 10, 2023 Patched in ["2.9.5"] CVE-2023-5951

Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection Critical

November 10, 2023 Patched in ["2.9.5"] CVE-2023-5952

Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload High

September 26, 2023 Patched in ["2.8.22"] CVE-2023-40219

Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs High

September 14, 2023 Patched in ["2.8.22"] CVE-2023-43493

Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection High

September 14, 2023 Patched in ["2.8.22"] CVE-2023-43610

Welcart e-Commerce <= 2.8.10 - Unauthenticated Stored Cross-Site Scripting High

January 27, 2023 Patched in ["2.8.11"] CVE-2023-22705

Welcart e-Commerce <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

December 23, 2022 Patched in ["2.8.9"] CVE-2022-4655

Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization Medium

December 5, 2022 Patched in ["2.8.6"] CVE-2022-4237

Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read Medium

December 5, 2022 Patched in ["2.8.5"] CVE-2022-4236

Welcart e-Commerce 2.6.10-2.8.4 - Information Disclosure via Arbitrary File Read High

November 30, 2022 Patched in ["2.8.5"] CVE-2022-4140

Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery High

November 28, 2022 Patched in ["2.8.4"]

Welcart e-Commerce <= 2.8.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

November 21, 2022 Patched in ["2.8.4"] CVE-2022-3935

Welcart e-Commerce <= 2.8.3 - Missing Authorization Medium

November 21, 2022 Patched in ["2.8.4"] CVE-2022-3946

Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery High

November 16, 2022 Patched in ["2.8.4"]

Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read High

September 2, 2022 Patched in ["2.7.8"] CVE-2022-41840

Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure High

August 6, 2021 Patched in ["2.2.8"] CVE-2021-4355

Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure Medium

August 6, 2021 Patched in ["2.2.8"] CVE-2021-4375

Welcart e-Commerce <= 2.2.3 - Reflected Cross-Site Scripting Medium

June 11, 2021 Patched in ["2.2.4"] CVE-2021-20734

Welcart e-Commerce <= 2.1.0 - SQL Injection High

February 8, 2021 Patched in ["2.1.1"]

Welcart e-Commerce <= 1.9.35 - PHP Object Injection High

November 5, 2020 Patched in ["1.9.36"] CVE-2020-28339

Welcart e-Commerce <= 1.8.2 - Cross-Site Scripting Medium

June 24, 2016 Patched in ["1.8.3"] CVE-2016-4827

Welcart e-Commerce <= 1.8.2 - Authentication Bypass Critical

June 24, 2016 Patched in ["1.8.3"] CVE-2016-4828

Welcart e-Commerce < 1.8.3 - Object Injection High

June 24, 2016 Patched in ["1.8.3"] CVE-2016-4825

Welcart e-Commerce < 1.8.3 - Reflected Cross-Site Scripting Medium

June 24, 2016 Patched in ["1.8.3"] CVE-2016-4826

Welcart e-Commerce < 1.5.3 - SQL Injection High

December 17, 2015 Patched in ["1.5.3"] CVE-2015-7791

Welcart e-Commerce < 1.4.18 - Multiple Cross-Site Scripting High

July 15, 2015 Patched in ["1.4.18"] CVE-2015-2973

Welcart e-Commerce <= 2.9.1 - SQL Injection Critical

March 4, 2014 Patched in ["2.9.2"] CVE-2014-10017

Welcart e-Commerce <= 1.3.12 - Cross-Site Scripting Medium

March 3, 2014 Patched in [] CVE-2014-10016

Welcart e-Commerce < 1.2.2 - Cross-Site Scripting Medium

December 14, 2012 Patched in ["1.2.2"] CVE-2012-5177

Welcart e-Commerce < 1.2.2 - Cross-Site Request Forgery High

December 14, 2012 Patched in ["1.2.2"] CVE-2012-5178

What It Does

Welcart e-Commerce is a full shopping cart and store management plugin for WordPress, allowing site owners to list products, manage orders, and process payments directly from their site. It bundles storefront features like a cart system, checkout flow, and member account tools into a single free package. The plugin is positioned primarily for the Japanese market but functions as a general-purpose e-commerce solution.

Who It's For

This plugin is best suited for small to mid-sized businesses targeting Japanese customers, since it holds the top market share domestically and likely has documentation, payment gateway support, and tax handling optimized for that audience. It's also a reasonable option for any shop owner wanting a free, self-contained cart solution without tying into WooCommerce or Ecwid's hosted ecosystem.

Who Should Skip It

If you run an English-language store, sell internationally, or need a large extension marketplace (WooCommerce, Ecwid, or Shopify-backed tools will give you far more flexibility). Site owners who want proven community support in English should also look elsewhere given the 0% resolved support thread rate here.

The Bottom Line

Welcart e-Commerce is a well-maintained, full-featured shopping plugin that scores 78.91/100 overall, and it's hard to beat if your audience is in Japan. Outside that market, the lack of public English support history and the dominance of WooCommerce and Ecwid make it a less obvious choice. Treat it as a strong regional solution rather than a global default.

Related Plugins

Menu Cart for WooCommerce 83/100

Pick this instead if you already run WooCommerce and just need a lightweight cart icon in your navigation menu.

Ecwid by Lightspeed Ecommerce Shopping Cart 80/100

Choose Ecwid if you want a hosted product catalogue that syncs across your site, social channels, and point-of-sale systems.

Simple Shopping Cart 79/100

Pick Simple Shopping Cart for a no-frills PayPal-focused checkout on a basic site, without the overhead of a full store platform.

WP Menu Cart 79/100

Choose this for a minimal cart widget add-on and nothing more, similar in scope to the WooCommerce menu cart option.

Bulgarisation for WooCommerce 79/100

Pick this only if you specifically need Bulgarian localization features layered on top of WooCommerce.