eCommerce Product Catalog EUVD-2026-41359

Exploitation requires an unauthenticated attacker to deliver a crafted request/input to the eCommerce Product Catalog plugin (versions <= 3.5.4) and, critically, requires user interaction (UI:R) - a victim must open the malicious link or view the attacker-poisoned catalog/product page for the injected script to execute. What limits exploitation: the payload only runs in the browser of a user who visits the crafted resource, so impact depends on luring a privileged user (e.g., an administrator) for meaningful account takeover, and the site must be running the eCommerce Product Catalog plugin at or below version 3.5.4. No login is needed to inject/deliver the payload (PR:N), but the required victim interaction and browser-only execution scope meaningfully constrain automated mass exploitation.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L yields a 7.1 (High) driven by network reach, low complexity, and no authentication, but tempered by the required user interaction (UI:R) and only Low confidentiality/integrity/availability impacts typical of XSS. No EPSS score was provided, so exploitation probability cannot be quantified from this data. There is no CISA KEV entry and no indication of public POC code, which places this below actively-exploited priority; the realistic risk is opportunistic session/credential theft or admin-account takeover if an attacker can lure a privileged user to a crafted request or poisoned catalog page. Because the source (Patchstack) does not disclose whether the XSS is reflected or stored, and no fix version is provided, the true urgency is moderate - treat as a should-patch-promptly issue for internet-facing stores rather than an emergency, while noting the unauthenticated vector makes it easy to attempt at scale.

An attacker crafts a URL or catalog input containing a malicious JavaScript payload targeting the vulnerable plugin parameter and emails or links it to a store administrator or logged-in shopper. When the victim opens the link or views the poisoned product page (UI:R), the script executes in their browser and steals session cookies or performs actions as that user, potentially leading to admin-account takeover. No authentication is required to plant or deliver the payload (PR:N), though no public exploit code has been identified at time of analysis.