CVE-2026-120597 in e-Commerce Plugin
Summary
by MITRE • 11/03/2026
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
A critical security flaw has been identified within the Welcart e-Commerce Plugin for WordPress, specifically affecting versions up to 2.12.6. This vulnerability resides in the ESCOTT_MAIN::error_page_message function located in the classes/paymentESCOTT.main.php file. The core technical issue is a failure to properly sanitize user-supplied input before it is rendered in the web browser context. Specifically, the ResponseCd argument passed through this function is not adequately escaped or validated prior to output. This lack of sanitization allows an attacker to inject malicious scripts into the application's response stream. When a victim interacts with a manipulated page containing these injected payloads, the browser executes the arbitrary code as if it were part of the legitimate website content.
This specific technical flaw constitutes a classic Stored Cross-Site Scripting vulnerability, which aligns with CWE-79 in the Common Weakness Enumeration standard. The severity is compounded by the fact that this attack vector can be launched remotely without requiring any form of authentication or prior interaction from the victim beyond visiting the compromised page. Because the exploit code for this vulnerability has been publicly disclosed and is actively available, the risk of exploitation in the wild is significantly elevated. Attackers can leverage these public exploits to target unpatched installations en masse, potentially leading to session hijacking, credential theft via keylogging scripts, or defacement of the e-commerce storefront by injecting malicious content into product pages or checkout flows.
The operational impact of this vulnerability extends beyond simple script execution. In an e-commerce environment like Welcart, successful exploitation could allow attackers to steal sensitive customer data such as login credentials, session cookies, and potentially payment information if it is exposed in the client-side context. Furthermore, malicious scripts can be used to redirect users to phishing sites or distribute malware through drive-by downloads. The public availability of exploits means that automated scanning tools are likely already probing for this specific weakness across the internet, making immediate remediation essential to prevent compromise.
To mitigate this risk, it is strongly recommended that all administrators running Welcart e-Commerce Plugin upgrade immediately to version 2.12.7 or later. The vendor has addressed this issue by implementing proper output encoding using the esc_html() function before rendering the ResponseCd value in the browser. This change ensures that any special characters are converted into their HTML entity equivalents, thereby preventing the browser from interpreting them as executable code. Organizations should verify their current plugin version and apply updates through the WordPress dashboard or via command line tools if available. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by filtering out known malicious payloads associated with cross-site scripting attacks while patching efforts are completed.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK technique T1059, specifically the execution of scripts within web browsers, and relates to initial access vectors where attackers exploit software vulnerabilities to gain a foothold in a target environment. The vendor's response was prompt and professional, highlighting the importance of maintaining up-to-date dependencies in WordPress ecosystems. Regular security audits and monitoring for plugin updates are critical practices for any organization relying on third-party e-commerce solutions to maintain a secure operational posture against evolving cyber threats.