CVE-2026-120597 | Welcart e-Commerce Plugin up to 2.12.6 on WordPress paymentESCOTT.main.class.php error_page_message ResponseCd cross site scripting

A vulnerability was found in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. It has been declared as problematic. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting.

This vulnerability is uniquely identified as CVE-2026-120597. The attack can be launched remotely. Moreover, an exploit is present.

It is recommended to upgrade the affected component.

The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.VulDB Recent EntriesRead More