CVE-2025-58992
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Product Catalog Simple plugin by impleCode has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.8.2.
Risk Assessment
An attacker can inject malicious script that executes in the browser of an administrator or user, potentially leading to session theft, defacement, or other harm.
Recommendation
Update the Product Catalog Simple plugin to the latest version that includes a fix. Additionally, follow secure coding practices such as output encoding and input validation.
Other vulnerabilities in Product Catalog Simple
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS