eCommerce Product Catalog CVE-2026-76128

Exploitation unconditionally requires an authenticated WordPress account with at minimum contributor-level permissions - unauthenticated exploitation is not possible (CVSS PR:L confirms this). The eCommerce Product Catalog plugin (by implecode, version ≤3.5.10) must be installed and active on the target site. The attacker must exercise the ability to create or edit content containing shortcodes, which the contributor role permits by default in WordPress. No additional non-default plugin configuration is required; the vulnerability is present in the default post/page shortcode rendering path. Exploitation is bounded by the contributor-access requirement: on sites with closed or carefully managed registration, an attacker must first obtain or compromise credentials. The scope change (S:C) means downstream impact extends to all users who visit an injected page, including administrators, making account takeover a realistic second-stage outcome.

The CVSS 6.4 Medium score with a Changed Scope reflects a genuine cross-context impact: the contributor-level attacker can affect all site visitors, including administrators, which elevates real-world severity beyond a typical contributor-permission vulnerability. AV:N and AC:L confirm no special network conditions or complex preconditions are required beyond the plugin being installed and active. PR:L is the primary gate - contributor access is mandatory and constitutes the most meaningful limiting factor. On sites with closed registration or tightly managed roles, the risk is materially lower; on sites with open contributor sign-up (common in community or multi-author WordPress deployments), the barrier is trivial. No EPSS score was provided in the input; for stored XSS in a WordPress eCommerce plugin with a moderate install base, exploitation probability is moderate in aggregate given the size of the WordPress ecosystem. The CVE is not listed in CISA KEV and no confirmed POC code has been identified, which reduces urgency compared to actively exploited stored-XSS issues. The UI:N metric warrants clarification: while the attacker performs no user-interaction step, a victim must navigate to an injected page - this is standard stored XSS behavior and is correctly represented as UI:N under CVSS 3.1 semantics. The existence of upstream changeset 3656358 suggests remediation is available, reducing the window of exposure for patched sites significantly.

An attacker registers a contributor account on a WordPress site running eCommerce Product Catalog ≤3.5.10 (or compromises an existing contributor's credentials), then creates a post embedding a shortcode with a malicious 'style' attribute payload such as injected JavaScript. When any site visitor - including a logged-in administrator - loads the page, the shortcode handler renders the unescaped attribute as live HTML, executing the attacker's script and potentially exfiltrating the victim's session cookie to an attacker-controlled endpoint. No confirmed public POC has been identified, but the shortcode-bypass technique is well-understood in the WordPress security community and replication is straightforward for a competent attacker.