eCommerce Product Catalog CVE-2026-116851

Exploitation targets the eCommerce Product Catalog WordPress plugin at version 3.6.5 or earlier; no authentication is required (PR:N). The decisive limiting factor is required user interaction (UI:R): the injected script executes only when a victim loads or interacts with the attacker-influenced content, so success depends on luring or waiting for a user (e.g., an admin or shopper) to visit the crafted page. The exact feature, parameter, or input field that carries the payload is not described in the available sources. No special non-default configuration is stated as a prerequisite in the evidence.

This is a moderate-severity reflected/stored Cross-Site Scripting flaw (CVSS 7.1) rather than a top-priority emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates a network-reachable, low-complexity, unauthenticated issue whose execution depends on user interaction (UI:R) - a victim must load or click attacker-influenced content for the injected script to fire. The scope change (S:C) and the low C/I/A impacts are consistent with XSS executing in the victim's browser session rather than compromising the server directly. No EPSS score and no CISA KEV listing were supplied, and the vuln.today decision label is 'this_week' (not act_now/emergency), so the signals collectively point to a plugin-specific issue worth patching on a normal weekly cadence rather than drop-everything urgency. The sole reference is the Patchstack database advisory; no exploitation probability, KEV flag, or working exploit code is present in the input, so real-world exploitation likelihood cannot be quantified from the data provided - treat the risk as a credible but unconfirmed-in-the-wild web vulnerability.

An unauthenticated attacker crafts a request or input containing malicious JavaScript targeting a vulnerable parameter in the eCommerce Product Catalog plugin (<= 3.6.5); when an administrator or shopper loads the affected page, the script executes in their browser session. Because user interaction is required (UI:R), the attacker typically lures a victim to a crafted link or page. No public exploit identified at time of analysis; the trigger parameter is not described in the available sources.