What is the CVSS score of CVE-2026-57360?

CVE-2026-57360 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of eCommerce Product Catalog are affected by CVE-2026-57360?

The implecode eCommerce Product Catalog WordPress plugin (versions ≤3.5.4) contains an unauthenticated cross-site scripting vulnerability that could allow attackers to hijack customer and…

How to fix or mitigate CVE-2026-57360?

Within 24 hours: Audit all WordPress instances for implecode plugin presence and identify affected versions; disable the plugin if operationally feasible or restrict public store access. Within 7 days: Deploy WAF rules to block XSS payloads; implement Content Security Policy headers (default-src 'self'; script-src 'self') to prevent script injection execution. Within 30 days: Contact implecode vendor for patch timeline; evaluate alternative eCommerce plugins (e.g., WooCommerce, Easy Digital Downloads) and plan migration if vendor support is unresponsive.

eCommerce Product Catalog CVE-2026-57360

EUVD-2026-41359 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-3mg3-686g-v244

WordPress XSS Ecommerce Product Catalog Wordpress Plugin Implecode

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (AV:N/PR:N) needs victim click (UI:R); script escapes plugin context (S:C) with limited browser-scoped C/I/A impact, matching the reported 7.1.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:17 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

AnalysisAI

Cross-site scripting in the implecode eCommerce Product Catalog WordPress plugin (all versions through 3.5.4) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser session, with no login required (PR:N) but a user interaction step to trigger the payload (UI:R). Reported by Patchstack and rated CVSS 7.1, the scope-changing flaw can hijack administrator or shopper sessions on affected online stores. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a plausible-impact issue rather than a confirmed active-exploitation event.

Technical ContextAI

The affected component is the eCommerce Product Catalog plugin (vendor implecode, CPE cpe:2.3:a:implecode:ecommerce_product_catalog), a PHP-based WordPress extension that renders product listings, categories, and shopping-cart pages inside a WordPress site. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input reaches an HTML response context without adequate output encoding or input sanitization, allowing browser-interpreted markup/JavaScript to be injected. Because WordPress plugins run in the shared trust context of the site, XSS here executes with the privileges of whichever authenticated user (including administrators) views the poisoned page, and the CVSS scope-changed flag (S:C) reflects that the injected script crosses from the vulnerable plugin into the broader browser/site security context.

RemediationAI

No vendor-released patch version is identified at time of analysis; the input specifies affected versions '<= 3.5.4' but no confirmed fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ecommerce-product-catalog/vulnerability/wordpress-ecommerce-product-catalog-plugin-3-5-4-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for any release above 3.5.4 and upgrade immediately once confirmed. As compensating controls until a verified patch is applied, deploy a Web Application Firewall or Patchstack's virtual patching to filter XSS payloads on the plugin's product/catalog endpoints (trade-off: WAF rules can be bypassed by novel encodings and may false-positive on legitimate rich content), add a restrictive Content-Security-Policy that disallows inline scripts to blunt injected JavaScript execution (trade-off: may break plugins/themes that rely on inline JS and requires testing), and if the catalog is not business-critical, deactivate the plugin entirely to remove the exposure. Avoid inventing a fix version - verify the exact patched release directly with implecode or Patchstack before communicating a target build.