CVE-2021-47924
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject malicious scripts via the price parameter by submitting POST requests to post.php with HTML/JavaScript payloads, executing arbitrary code when the product is viewed.
Risk Assessment
An attacker can execute malicious scripts in the browser of an administrator or other users viewing the product, potentially leading to session theft or other actions.
Recommendation
Update the Ultimate Product Catalogue plugin to the latest version that includes a fix for this XSS vulnerability.
Original NVD description (English source)
Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter. Attackers can submit POST requests to post.php with HTML/JavaScript payloads in the price field to execute arbitrary code when the product is viewed.