Welcart e-Commerce EUVD-2026-115649

Exploitation targets the ESCOTT_MAIN::error_page_message function in classes/paymentESCOTT.main.class.php, where the ResponseCd argument is reflected into the error page output without escaping. Per the CVSS 4.0 vector (PR:N), no authentication is required, but exploitation requires user interaction (UI:P): a victim must open an attacker-crafted request/link, so this is reflected XSS rather than a no-click flaw. It affects Welcart e-Commerce Plugin versions up to and including 2.12.6; version 2.12.7 remediates it by escaping the value with esc_html(). The limiting factors are the need to induce victim interaction and the requirement that the target site runs a vulnerable (≤2.12.6) version of this specific plugin.

This is a moderate, genuinely low-urgency issue rather than a high-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, score 5.3) describes a remotely reachable, unauthenticated, low-complexity reflected cross-site scripting flaw whose exploitation nonetheless requires victim user interaction (UI:P) and yields only low integrity impact with no confidentiality or availability impact in the vendor's assessment. The vuln.today decision label is 'this_month', consistent with a medium-severity, non-critical finding. There is no CISA KEV listing in the input, so there is no confirmed active exploitation, and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from this data - this absence is a gap, not evidence of low risk. A public PoC reference exists (a GitHub repository) but the input states it is not verified as working exploit code, so it should not be treated as a weaponized exploit. The signals are internally consistent (medium CVSS, reflected XSS requiring user interaction, 'this_month' priority, no KEV); the main caveat is that EPSS is missing, so quantitative exploitation likelihood is unknown.

An attacker crafts a malicious URL containing a scripted payload in the ResponseCd parameter and lures a victim (for example via phishing or a malicious link) into visiting the affected plugin's error page on a vulnerable WordPress site. Because the value is reflected into the error page without escaping, the script executes in the victim's browser in the site's context, enabling session/cookie theft or UI manipulation. A public PoC reference exists but is not verified as working exploit code.