EUVD-2026-65357
GHSA-483m-qrc2-mqgh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects mandatory contributor authentication; S:C captures cross-context browser impact on victims; A:N because stored XSS does not affect availability.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags; the tainted HTML output is only generated at render time by the shortcode handler.
AnalysisAI
Stored XSS in the eCommerce Product Catalog WordPress plugin (≤3.5.10) by implecode allows any authenticated contributor to persist malicious JavaScript via the 'style' shortcode attribute, bypassing WordPress's save-time wp_kses_post sanitization because the payload is stored inside shortcode brackets containing no HTML tags, with dangerous markup generated only at render time by the shortcode handler. Every subsequent visitor to an injected page executes the attacker's script in their browser context, enabling session hijacking, credential theft, or malicious redirects against administrators and customers alike. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation unconditionally requires an authenticated WordPress account with at minimum contributor-level permissions - unauthenticated exploitation is not possible (CVSS PR:L confirms this). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 Medium score with a Changed Scope reflects a genuine cross-context impact: the contributor-level attacker can affect all site visitors, including administrators, which elevates real-world severity beyond a typical contributor-permission vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a contributor account on a WordPress site running eCommerce Product Catalog ≤3.5.10 (or compromises an existing contributor's credentials), then creates a post embedding a shortcode with a malicious 'style' attribute payload such as injected JavaScript. When any site visitor - including a logged-in administrator - loads the page, the shortcode handler renders the unescaped attribute as live HTML, executing the attacker's script and potentially exfiltrating the victim's session cookie to an attacker-controlled endpoint. … |
| Remediation | The primary remediation is to update the eCommerce Product Catalog plugin to the version that incorporates upstream changeset 3656358 (https://plugins.trac.wordpress.org/changeset/3656358/); administrators should check the WordPress plugin repository for the current patched release and apply it immediately via the WordPress admin dashboard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ecommerce Product Catalog
View allThe eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter
Unauthenticated SQL injection in the implecode eCommerce Product Catalog WordPress plugin (versions 3.5.5 and earlier) a
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in v
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in v
Cross-site scripting in the implecode eCommerce Product Catalog WordPress plugin (all versions through 3.5.4) lets unaut
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin p
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin f
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerc
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today