CVE-2026-120597
Deferred
Deferred - Pending Action
XSS in Welcart e-Commerce WordPress Plugin
Vulnerability report for CVE-2026-120597, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-02
Last updated on: 2026-11-02
Assigner: VulDB
Description
Description
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Welcart | e-Commerce Plugin | 2.12.0 |
| Welcart | e-Commerce Plugin | 2.12.1 |
| Welcart | e-Commerce Plugin | 2.12.2 |
| Welcart | e-Commerce Plugin | 2.12.3 |
| Welcart | e-Commerce Plugin | 2.12.4 |
| Welcart | e-Commerce Plugin | 2.12.5 |
| Welcart | e-Commerce Plugin | 2.12.6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
