Live › vulnerability › CVE-2026-120597
Welcart e-Commerce for WordPress up to version 2.12.6 does not escape the ResponseCd value on its payment error page. An attacker can craft a link that runs script in the browser of a visitor who opens it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 23:35 UTC. All times on this page are UTC.
Online shops running Welcart e-Commerce on WordPress up to 2.12.6 with the ESCOTT payment module are exposed when the error page reflects the ResponseCd value. Sites that do not use the ESCOTT payment path, or that already run 2.12.7 or later, are not affected.
No product ranges from the sources yet.
2.12.7 or later, per the source.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-120597")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.