---
id: "CVE-2026-120597"
kind: "vulnerability"
aliases: ["CVE-2026-120597"]
title: "Welcart e-Commerce plugin: payment error page allows cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "welcart", "woocommerce-alternative", "wordpress"]
not_affected_if: ["fixed-version", "no-escott-payment"]
published_at: "2026-11-02T23:17:19+00:00"
first_seen_at: "2026-11-02T23:35:57+00:00"
updated_at: "2026-11-02T23:36:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120597", "first_seen_at": "2026-11-02T23:35:57+00:00"}]
---

# Welcart e-Commerce plugin: payment error page allows cross-site scripting

Welcart e-Commerce for WordPress up to version 2.12.6 does not escape the ResponseCd value on its payment error page. An attacker can craft a link that runs script in the browser of a visitor who opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Welcart e-Commerce plugin version in the WordPress admin plugin list or in the plugin's main file header.
- Confirm whether the site uses the ESCOTT payment module (classes/paymentESCOTT.main.class.php).

## Fix

- Welcart e-Commerce `2.12.7` or later, per the source.

## Timeline

- 2026-11-02T23:35:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120597

## From the sources

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_