CVE-2026-57360
HighCVSS 7.1Summary
The eCommerce Product Catalog plugin version 3.5.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
Risk Assessment
The risk includes user session theft, redirects to malicious sites, and e-commerce store defacement. The attack can affect all website visitors.
Recommendation
Immediately update the eCommerce Product Catalog plugin to a version newer than 3.5.4. If no update is available, temporarily disable the plugin.
Other vulnerabilities in eCommerce Product Catalog
See all- CVE-2026-52693Critical
Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.
- CVE-2026-76128Medium
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to and including 3.5.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.