The Welcart e‑Commerce Plugin for WordPress contains a flaw in the ESCOTT_MAIN::error_page_message function that fails to properly escape the ResponseCd parameter. By providing a crafted value for this argument, an attacker can inject arbitrary JavaScript into the error page that is rendered in the victim’s browser. The flaw is triggered remotely and does not require local or administrative access; the exploit scripts are publicly available on GitHub and other vulnerability databases.

All installations of Welcart e‑Commerce Plugin on WordPress with a version of 2.12.6 or earlier are affected. The vendor lists the problematic plugin as Welcart:e‑Commerce Plugin. The advisory recommends upgrading to version 2.12.7, which applies the missing esc_html() sanitization in the response output.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, but public proofs of concept exist, so attackers could realistically exploit it. The attack vector is remote through manipulation of the ResponseCd argument, and no special privileges are needed, which amplifies the risk for all exposed systems.