eCommerce Product Catalog CVE-2026-115596

Exploitation requires the attacker to craft a request to an affected eCommerce Product Catalog endpoint carrying a script payload in a reflected input, and then to induce a victim to follow that attacker-controlled link (UI:R) - the flaw cannot trigger on its own. No authentication is required (PR:N), so the attacker needs no account. The exact vulnerable parameter, page, or configuration is not described in the available sources. The primary limiting factor is the mandatory victim interaction (clicking/opening the crafted link); as reflected XSS, the payload is not stored, so each successful attack depends on separately delivering the link to each target.

This is a reflected cross-site scripting flaw (CWE-79) in the impleCode eCommerce Product Catalog WordPress plugin, affecting all versions up to and including 3.6.4. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) yields 7.1 (High), with the elevated score driven largely by the scope change (S:C) and the lack of authentication (PR:N); the required user interaction (UI:R) is the main factor dampening real-world severity, since the attack cannot fire without a victim acting on an attacker-supplied link. Decision signals are mixed and mostly moderate: the vuln.today priority is 'this_week' (not act_now/emergency), there is no CISA KEV listing, no EPSS probability was provided in the input, and no verified exploit code is present - only the Patchstack disclosure advisory. There is no confirmed active exploitation. Net assessment: this is a legitimate but not emergency-grade issue - a classic Patchstack-reported reflected XSS whose practical risk depends on social engineering rather than mass automated exploitation. EPSS is missing, so widespread-exploitation likelihood cannot be quantified from the data; treat the 'this_week' label as the operative urgency signal. The exact injectable parameter is not described in the available sources, which limits confidence in how easily the flaw can be triggered.

An attacker crafts a URL pointing at an affected eCommerce Product Catalog endpoint with a malicious script embedded in a reflected parameter, then lures a site visitor or administrator into clicking it (e.g., via phishing). When the victim's browser loads the page, the plugin reflects the unsanitized input and the script executes in the victim's session, enabling actions such as session/cookie theft or content manipulation. No public, verified exploit code was identified at time of analysis; only the Patchstack advisory reference exists.