E Commerce Plugin
Monthly
Reflected cross-site scripting in the Welcart e-Commerce plugin for WordPress (versions up to and including 2.12.6) lets remote attackers inject script into the payment error page generated by ESCOTT_MAIN::error_page_message through the unsanitized ResponseCd argument. The CVSS 4.0 vector indicates no privileges are required (PR:N) but the victim must interact (UI:P), since a crafted request or link has to be opened for the payload to execute, and impact is limited to low integrity/confidentiality effects within the page context. Version 2.12.7 fixes the issue by escaping the value with esc_html(); a public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and this is assessed as a moderate, genuinely low-urgency issue rather than a high-priority emergency, consistent with a this_month priority label.
Reflected cross-site scripting in the Welcart e-Commerce plugin for WordPress (versions up to and including 2.12.6) lets remote attackers inject script into the payment error page generated by ESCOTT_MAIN::error_page_message through the unsanitized ResponseCd argument. The CVSS 4.0 vector indicates no privileges are required (PR:N) but the victim must interact (UI:P), since a crafted request or link has to be opened for the payload to execute, and impact is limited to low integrity/confidentiality effects within the page context. Version 2.12.7 fixes the issue by escaping the value with esc_html(); a public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and this is assessed as a moderate, genuinely low-urgency issue rather than a high-priority emergency, consistent with a this_month priority label.