# CVE-2026-120597: Welcart e-Commerce Plugin reflected XSS in payment error handling

Source: https://junglewise.ai/threats/cve-2026-120597-a-vulnerability-was-identified-in-welcart-e-commerce-plugin-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120597 · Severity: medium · CVSS 4.3 · Published 2026-11-02

Welcart e-Commerce is a WordPress plugin that manages online storefronts and payment processing. An unauthenticated attacker can inject malicious JavaScript into error pages by crafting a specially-crafted link, allowing account takeover, credential theft, or malware distribution to site visitors. The e-SCOTT Smart payment gateway must be enabled for the vulnerability to be accessible.

Vendors: [Welcart](https://junglewise.ai/threats/vendors/welcart).

## Quick answers

**Is CVE-2026-120597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120597 being exploited in the wild.

**How severe is CVE-2026-120597?** Medium severity, with a CVSS score of 4.3, published 2 November 2026.

**Which products and versions are affected?** Welcart e-Commerce Plugin up to 2.12.6.

**Is there a fix for CVE-2026-120597?** Yes: fixed in 2.12.7. Until then: Deactivate the e-SCOTT Smart payment gateway (set escott.activate and conv_activate to 'off') until the plugin is upgraded to version 2.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120597 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120597?** Check whether you run Welcart e-Commerce Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.12.7

Deactivate the e-SCOTT Smart payment gateway (set escott.activate and conv_activate to 'off') until the plugin is upgraded to version 2.12.7 or later.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the ESCOTT_MAIN::error_page_message() function in classes/paymentESCOTT.main.class.php, where the ResponseCd parameter is reflected without proper HTML escaping. An unauthenticated attacker can reach this sink by sending a crafted GET request to the cart page with acting_return=1 and MerchantFree2=acting_escott_conv parameters, bypassing IP guards and nonce checks. The vulnerability is fixed by escaping output with esc_html() before rendering.

## Affected products

- Welcart e-Commerce Plugin up to 2.12.6

## Timeline

- 2026-11-02: disclosed: CVE-2026-120597 published
- 2026-11-02: patched: Fix released in version 2.12.7 with esc_html() escaping applied

## References

- [https://github.com/bevennyamande/welcart-poc](https://github.com/bevennyamande/welcart-poc)
- [https://vuldb.com/cve/CVE-2026-120597](https://vuldb.com/cve/CVE-2026-120597)