/Vulnerability Library

WordPress Welcart e-Commerce < 2.12.7 - Cross-Site Scripting

CVE-2026-120597
Early Release

Description

Welcart e-Commerce Plugin up to 2.12.6 contains a stored XSS caused by improper escaping of the ResponseCd argument in ESCOTT_MAIN::error_page_message, letting remote attackers execute scripts, exploit requires crafted input.

Severity

Medium

CVSS Score

4.3

Exploit Probability

0%

Affected Product

welcart_e-commerce

Published Date

November 5, 2026

Template Author

maulanawirawan

CVE-2026-120597.yaml
4.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVE ID:
cve-2026-120597
CWE ID:
cwe-79

References

https://nvd.nist.gov/vuln/detail/CVE-2026-120597https://github.com/bevennyamande/welcart-pochttps://wordpress.org/plugins/usc-e-shop/

Remediation Steps

Upgrade to version 2.12.7.