Cross-Site Scripting in Welcart e-Commerce Plugin by WordPress
CVE-2026-120597

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
E-commerce Plugin
Vendor
CVE Published:
2 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-120597?

A vulnerability in the Welcart e-Commerce Plugin allows attackers to execute cross-site scripting (XSS) attacks by manipulating the ResponseCd argument in the error_page_message function of the classes/paymentESCOTT.main.class.php file. This vulnerability can be exploited remotely, and the exploit is publicly available. Upgrading to version 2.12.7 of the plugin is recommended, as it implements proper escaping with esc_html() before outputting values. The vendor responded swiftly to reports of this issue and released a fix to safeguard users.

Affected Version(s)

e-Commerce Plugin 2.12.0

e-Commerce Plugin 2.12.1

e-Commerce Plugin 2.12.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-120597 - Proof of Concept

References

https://vuldb.com/vuln/429933
vdb-entrytechnical-description
https://vuldb.com/vuln/429933/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-120597
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xbeven (VulDB User)
VulDB CNA Team
.