EUVD-2026-115649

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...

CVE-2026-120597

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...

CVE-2026-120597

The Welcart e-Commerce Plugin for WordPress (versions up to 2.12.6 ) is vulnerable to a remote cross-site scripting (XSS) attack. The issue originates from the ESCOTT_MAIN::error_page_message function within the classes/paymentESCOTT.main.class.php file, where the ResponseCd argument is improperl...

CVE-2026-120597 Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...

CVE-2026-120597: Welcart e-Commerce Plugin: A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...

PT-2026-135829

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT MAIN::error page message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...

CVE-2026-118070

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-119166

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'memberID' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existin...

CVE-2026-119166

The Welcart e-Commerce plugin for WordPress (versions up to and including 2.12.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a lack of validation on the 'member[ID]' parameter, allowing unauthenticated attackers to overwrite the email address and password of ...

EUVD-2026-114615

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'memberID' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existin...

CVE-2026-119166 Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'memberID' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existin...

CVE-2026-118070 Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-114609

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-118070

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.12.5 . The root cause is insufficient input sanitization and output escaping of the 'gid' parameter . An unauthenticated attacker can forge a ROBOT PAYMENT browser-retu...

CVE-2026-118070 Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-118070: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all…

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-134458

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.6 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Unauthenticated attackers can overwrite the email address and...

CVE-2026-119166: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,…

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'memberID' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existin...

WordPress Welcart e-Commerce plugin <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sawyer in WordPress Plugin Welcart e-Commerce versions = 2.12.5...

CVE-2022-4140

CVE-2022-4140 - WordPress plugin Welcart e-Commerce 2.8.5 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2022-4140. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own ...