Log in Start free

Vulnerability · Published Nov 2, 2026 · Assigned by VulDB

CVE-2026-120597Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

Medium 4.3

In plain English

A medium-severity cross-site scripting in e-Commerce Plugin from Welcart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.6%top 51.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei

Official description

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected products (as reported)

VendorProductVersions
Welcart e-Commerce Plugin 2.12.02.12.12.12.22.12.32.12.42.12.52.12.6

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References