eCommerce Product Catalog vulnerabilities
3 known CVE vulnerabilities in eCommerce Product Catalog, translated and rated.
- CVE-2026-57360High
The eCommerce Product Catalog plugin version 3.5.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-52693Critical
Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.
- CVE-2026-76128Medium
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to and including 3.5.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags.