EUVD-2026-69845
GHSA-c867-rxhp-5w2v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-reachable form, no auth or complexity; UI:R because a third-party visitor must trigger delivery; integrity-only impact confined to email content.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
AnalysisAI
Email content injection in the CatalogX WordPress plugin before 6.1.3 allows unauthenticated attackers to permanently plant unsanitized content into product enquiry notification emails delivered to site administrators. The injected payload is stored server-side upon submission of a product enquiry and is included verbatim in the administrator notification email each time any subsequent visitor triggers a new enquiry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CatalogX plugin must be installed and active on a WordPress site with the product enquiry feature enabled (this is a core plugin feature, not a non-default setting). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-low despite a publicly available proof-of-concept. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade CatalogX to version 6.1.3 or later, which applies input sanitization and output escaping to the product enquiry fields before they are embedded in notification emails. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today