Description
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Welcart | e-Commerce Plugin | 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.12.5, 2.12.6 | 2.12.7 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Welcart e-Commerce < 2.12.7 - Cross-Site Scripting http/cves/2026/CVE-2026-120597.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- VDB-429933 | Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting vdb-entry technical-description
- VDB-429933 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-120597 | CVE Analysis and Report third-party-advisory
- Submit #1039186 | Welcart e-Commerce Welcart e-Commerce (usc-e-shop) <= 2.12.5 Improper Neutralization of Alternate XSS Syntax third-party-advisory
- https://github.com/bevennyamande/welcart-poc exploit
- https://wordpress.org/plugins/usc-e-shop/ patch