uscnanbu has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 7.2 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-19887High· 8.8The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction)49CVE-2026-87091High· 7.2The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping40CVE-2026-107752Medium· 4.9Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie27
uscnanbu vulnerabilities
CVEs affecting uscnanbu, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-107752Medium· 4.9Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on…
CVE-2026-87091High· 7.2The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This…
CVE-2026-19887High· 8.8The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction)
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). …