eCommerce Product Catalog vulnerabilities

Custom role PHP Object Injection vulnerability in eCommerce Product Catalog up to version 3.6.0.

The eCommerce Product Catalog plugin version 3.5.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.

Stored XSS vulnerability in eCommerce Product Catalog plugin up to version 3.6.2. Allows injection of a persistent script that can execute in the user's browser context.

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to and including 3.5.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags.