CVE-2026-115596
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS. This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
Risk Assessment
Reflected XSS may allow an attacker to execute a malicious script in a victim's browser via a crafted link, potentially leading to session or data theft.
Recommendation
Update the eCommerce Product Catalog plugin to a version later than 3.6.4. Apply input validation and encoding in the application.
Other vulnerabilities in eCommerce Product Catalog
See all- CVE-2026-96344High
Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.
- CVE-2026-52693Critical
Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.
- CVE-2026-116851High
The WordPress plugin eCommerce Product Catalog in versions up to 3.6.5 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.
- CVE-2026-105056Medium
Stored XSS vulnerability in eCommerce Product Catalog plugin up to version 3.6.2. Allows injection of a persistent script that can execute in the user's browser context.
- CVE-2026-76128Medium
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to and including 3.5.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags.
- CVE-2026-57360High
The eCommerce Product Catalog plugin version 3.5.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS