CVE-2026-120597

MEDIUM 4.3

Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CWE	CWE-79 CWE-94
Vendor	welcart
Product	e-commerce plugin
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for welcart e-commerce plugin

Be the first to know when new medium vulnerabilities affecting welcart e-commerce plugin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Welcart / e-Commerce Plugin

2.12.0 2.12.1 2.12.2 2.12.3 2.12.4 2.12.5 2.12.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/429933 vuldb.com: https://vuldb.com/vuln/429933/cti vuldb.com: https://vuldb.com/cve/CVE-2026-120597 vuldb.com: https://vuldb.com/submit/1039186 github.com: https://github.com/bevennyamande/welcart-poc wordpress.org: https://wordpress.org/plugins/usc-e-shop/

Credits

🔍 0xbeven (VulDB User) VulDB CNA Team