CVE-2026-120597

Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

LOW 2.1EPSS 0.3%

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected: Welcart · e-Commerce Plugin
CVSS v4.0 VULDB: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULDB: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 VULDB: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS: 0.28% chance of exploitation in the next 30 days, 20th percentile
Published: 2026-11-02

Proof-of-concept exploits (1)

bevennyamande/welcart-pocRepo stars 0★ · pushed 2026-10-16 · snapshot
1 file
welcart_escott_xss_poc.py

CVE references

https://vuldb.com/cve/CVE-2026-120597ADVISORY
https://vuldb.com/submit/1039186ADVISORY
https://vuldb.com/vuln/429933REFERENCE
https://vuldb.com/vuln/429933/ctiREFERENCE
https://wordpress.org/plugins/usc-e-shopPATCH

CVE-2026-120597

Proof-of-concept exploits (1)

CVE references

References

Related