CVE-2026-96344
HighCVSS 7.2Summary
Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.
Risk Assessment
An attacker with a custom role can inject malicious PHP objects, potentially leading to remote code execution or other unauthorized actions.
Recommendation
Update the eCommerce Product Catalog plugin to a version that fixes this vulnerability.
Other vulnerabilities in eCommerce Product Catalog
See all- CVE-2026-57360High
The eCommerce Product Catalog plugin version 3.5.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-52693Critical
Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.
- CVE-2026-105056Medium
Stored XSS vulnerability in eCommerce Product Catalog plugin up to version 3.6.2. Allows injection of a persistent script that can execute in the user's browser context.
- CVE-2026-76128Medium
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to and including 3.5.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags.
Original NVD description (English source)
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS