Threats tagged 'ghsa-49rc-rvj9-jhxw'

A cross-site scripting (XSS) vulnerability exists in the Welcart e-Commerce Plugin for WordPress up to version 2.12.6. The flaw is in the ESCOTT_MAIN::error_page_message function within the classes/paymentESCOTT.main.class.php file, where the ResponseCd argument is not properly escaped. This vulnerability can be exploited remotely and public exploit code is available. The issue is fixed in version 2.12.7 by escaping the value with esc_html() before output.