eCommerce Product Catalog EUVD-2026-92317

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) capable of creating or editing eCommerce Product Catalog entries, since the payload must be stored through a plugin input field that improperly neutralizes HTML/JavaScript. The attack is further gated by user interaction (UI:R): a victim (typically an administrator or other user) must view the page where the malicious script is rendered for it to fire. Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous (some authenticated role on the target site is needed), the payload only triggers when a victim loads the affected catalog view, and the plugin must be installed and active - a niche e-commerce plugin rather than a default WordPress component.

This is a medium-severity stored Cross-Site Scripting flaw (CWE-79) in the impleCode eCommerce Product Catalog WordPress plugin (≤3.6.2), carrying a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity exploitation that nonetheless requires authenticated privileges (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that the injected script executes in a different security context (the victim's browser/session). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the source data, so there is no public exploit identified at time of analysis. The combination of required authentication, required user interaction, and only Low confidentiality/integrity/availability impacts places this well below the 'drop everything' tier: it is a genuine but bounded issue typical of Patchstack-reported WordPress plugin XSS, not evidence of widespread or automated exploitation. Note the data is single-source (Patchstack only) with no independent vendor advisory, and no EPSS/KEV signals are present to corroborate or contradict the CVSS rating - absence of those signals is not evidence of safety, but no active-exploitation indicator exists either.

A user with at least low-level authenticated access (e.g., a contributor or shop manager role) saves a product-catalog entry containing a malicious JavaScript payload in a field that is not properly neutralized. When an administrator or other user later views the affected catalog page in the WordPress dashboard or front end, the stored script executes in their browser session, potentially hijacking the session or performing actions on their behalf. No public exploit code was identified in the provided data.