{"id":"CVE-2026-120597","kind":"vulnerability","aliases":["CVE-2026-120597"],"related":[],"title":"Welcart e-Commerce plugin: payment error page allows cross-site scripting","description":"A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","summary":"Welcart e-Commerce for WordPress up to version 2.12.6 does not escape the ResponseCd value on its payment error page. An attacker can craft a link that runs script in the browser of a visitor who opens it.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","welcart","woocommerce-alternative","wordpress"],"not_affected_if":["fixed-version","no-escott-payment"],"how_to_check":"- Check the installed Welcart e-Commerce plugin version in the WordPress admin plugin list or in the plugin's main file header.\n- Confirm whether the site uses the ESCOTT payment module (classes/paymentESCOTT.main.class.php).","fix":"- Welcart e-Commerce `2.12.7` or later, per the source.","status":"open","published_at":"2026-11-02T23:17:19+00:00","first_seen_at":"2026-11-02T23:35:57+00:00","triaged_at":"2026-11-02T23:36:35+00:00","updated_at":"2026-11-02T23:36:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T23:36:35Z","model":"claude-haiku-5-5","output":{"fix":"- Welcart e-Commerce `2.12.7` or later, per the source.","reach":"internet","title":"Welcart e-Commerce plugin: payment error page allows cross-site scripting","impact":"medium","summary":"Welcart e-Commerce for WordPress up to version 2.12.6 does not escape the ResponseCd value on its payment error page. An attacker can craft a link that runs script in the browser of a visitor who opens it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce-alternative","welcart","ecommerce"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker script runs in a shopper's browser on the store domain","analyst_note":"","how_to_check":"- Check the installed Welcart e-Commerce plugin version in the WordPress admin plugin list or in the plugin's main file header.\n- Confirm whether the site uses the ESCOTT payment module (classes/paymentESCOTT.main.class.php).","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-escott-payment"],"who_is_affected":"Online shops running Welcart e-Commerce on WordPress up to 2.12.6 with the ESCOTT payment module are exposed when the error page reflects the ResponseCd value. Sites that do not use the ESCOTT payment path, or that already run 2.12.7 or later, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4247,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120597':16A,19A '-2026':15A,18A '2.12.6':36B,77C '2.12.7':122C 'affect':81C,132C,163C 'allow':9A 'altern':25B 'argument':97C 'attack':49B,105C 'avail':114C 'browser':59B 'classes/paymentescott.main.class.php':92C 'commerc':4A,30B,73C 'compon':133C 'contact':147C 'craft':51B 'cross':11A,101C 'cross-sit':10A 'cve':14A,17A 'e':3A,29B,72C 'e-commerc':2A,28B,71C 'earli':148C 'ecommerc':20B 'error':7A,46B,86C 'esc':140C 'escap':39B,138C 'escott':84C 'exploit':111C 'file':91C 'fix':159C 'function':83C 'html':141C 'identifi':68C 'issu':125C 'launch':108C 'lead':99C 'link':53B 'main':85C 'manipul':94C 'manner':154C 'messag':88C 'might':116C 'mitig':123C 'open':64B 'output':143C 'packag':21B 'page':8A,47B,87C 'payment':6A,45B 'plugin':5A,74C 'product':164C 'profession':153C 'public':113C 'quick':156C 'recommend':128C 'releas':157C 'remot':109C 'respond':149C 'responsecd':41B,98C 'run':55B 'script':13A,56B,103C 'site':12A,102C 'upgrad':119C,130C 'use':118C 'valu':42B,135C 'vendor':145C 'version':35B,121C,160C 'visitor':62B 'vulner':66C 'welcart':1A,22B,27B,70C 'woocommerc':24B 'woocommerce-altern':23B 'wordpress':26B,32B,79C","nicknames":[],"mitigations":[],"who_affected":"Online shops running Welcart e-Commerce on WordPress up to 2.12.6 with the ESCOTT payment module are exposed when the error page reflects the ResponseCd value. Sites that do not use the ESCOTT payment path, or that already run 2.12.7 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","medium","package","welcart","woocommercealternative","wordpress"],"first_public_at":"2026-11-02T23:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120597","severity":null,"published_at":"2026-11-02T23:17:19+00:00","modified_at":"2026-11-02T23:17:20+00:00","first_seen_at":"2026-11-02T23:35:57+00:00","fetched_at":"2026-11-02T23:35:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}