CVE-2026-105056
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Stored XSS vulnerability in eCommerce Product Catalog plugin up to version 3.6.2. Allows injection of a persistent script that can execute in the user's browser context.
Risk Assessment
Potential data theft, session hijacking, or malware propagation.
Recommendation
Update the eCommerce Product Catalog plugin to a patched version.
Other vulnerabilities in eCommerce Product Catalog
See all- CVE-2026-96344High
Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.
- CVE-2026-57360High
The eCommerce Product Catalog plugin version 3.5.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-52693Critical
Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.
- CVE-2026-76128Medium
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to and including 3.5.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS