جزئیات آسیب‌پذیری
CVE-2026-120597
Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 5.3متوسط | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| 4.3متوسط | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
| 4.3متوسط | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
| 5.0متوسط | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Welcart | e-Commerce Plugin | 2.12.0 | CVEProject cvelistV5 (CNA) |
| Welcart | e-Commerce Plugin | 2.12.1 | CVEProject cvelistV5 (CNA) |
| Welcart | e-Commerce Plugin | 2.12.2 | CVEProject cvelistV5 (CNA) |
| Welcart | e-Commerce Plugin | 2.12.3 | CVEProject cvelistV5 (CNA) |
| Welcart | e-Commerce Plugin | 2.12.4 | CVEProject cvelistV5 (CNA) |
| Welcart | e-Commerce Plugin | 2.12.5 | CVEProject cvelistV5 (CNA) |
| Welcart | e-Commerce Plugin | 2.12.6 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۶- https://vuldb.com/vuln/429933 vdb-entrytechnical-description
- https://vuldb.com/vuln/429933/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-120597 third-party-advisory
- https://vuldb.com/submit/1039186 third-party-advisory
- https://github.com/bevennyamande/welcart-poc exploit
- https://wordpress.org/plugins/usc-e-shop/ patch
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۲
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۲
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- VulDB
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- Automatable
- yes
- Exploitation
- poc
- Technical Impact
- partial
ضعف‌ها (CWE)
- CWE-79Cross Site Scripting
- CWE-94Code Injection