Implecode
Monthly
Unauthenticated cross-site scripting in the WordPress eCommerce Product Catalog plugin, affecting versions up to and including 3.6.5, allows remote attackers to inject script that executes in a victim's browser when that user loads or interacts with attacker-influenced content. The issue is rated CVSS 3.1 7.1 and requires user interaction (UI:R); no public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Reflected cross-site scripting (CWE-79) in the impleCode eCommerce Product Catalog WordPress plugin through version 3.6.4 allows a remote, unauthenticated attacker to run script in a victim's browser by persuading the victim to open a crafted URL that reflects an unsanitized input. Exploitation is constrained by the required victim interaction (UI:R) and the fact that the payload is not stored, so each target has to be lured individually; no public exploit code or proof-of-concept is referenced in the available intelligence, and the case is queued for handling this week under the vuln.today priority. No vendor-released fixed version is identified in the supplied data, and the advisory of record is the Patchstack database entry.
PHP object injection in the Implecode eCommerce Product Catalog plugin for WordPress (3.6.0 and earlier) allows an authenticated attacker holding a high-privilege custom role to feed crafted serialized data into PHP's unserialize(), enabling arbitrary object instantiation that can escalate to remote code execution where a usable POP gadget chain exists in loaded code. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), it carries full confidentiality, integrity and availability impact, but is access-gated: the high-privilege custom role requirement (PR:H) means anonymous and low-privileged users cannot reach the vulnerable path, so this is a genuine but access-gated risk rather than an internet-wide exposure. No public exploit identified at time of analysis.
Cross-site scripting in the implecode eCommerce Product Catalog WordPress plugin (all versions through 3.5.4) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser session, with no login required (PR:N) but a user interaction step to trigger the payload (UI:R). Reported by Patchstack and rated CVSS 7.1, the scope-changing flaw can hijack administrator or shopper sessions on affected online stores. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a plausible-impact issue rather than a confirmed active-exploitation event.
Unauthenticated SQL injection in the implecode eCommerce Product Catalog WordPress plugin (versions 3.5.5 and earlier) allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 9.3 score reflects a scope change with high confidentiality impact, meaning data outside the plugin's database context can be reached. No public exploit identified at time of analysis, though the Patchstack advisory confirms the vendor-tracked vulnerability class.
Stored cross-site scripting in impleCode's eCommerce Product Catalog plugin for WordPress (versions through 3.6.2) allows an authenticated user holding only low-level privileges to plant malicious JavaScript in catalog content, which then executes in the browser of any user - typically an administrator - who views the affected catalog page. The issue is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and the available intelligence shows no public exploit identified at time of analysis and no vendor-released patch version confirmed in the provided data. Real-world risk is constrained because the attacker needs some authenticated role on the target site and must wait for a victim to load the poisoned page, and the plugin has to be installed and active - it is a niche e-commerce plugin rather than a default WordPress component.
Stored XSS in the eCommerce Product Catalog WordPress plugin (≤3.5.10) by implecode allows any authenticated contributor to persist malicious JavaScript via the 'style' shortcode attribute, bypassing WordPress's save-time wp_kses_post sanitization because the payload is stored inside shortcode brackets containing no HTML tags, with dangerous markup generated only at render time by the shortcode handler. Every subsequent visitor to an injected page executes the attacker's script in their browser context, enabling session hijacking, credential theft, or malicious redirects against administrators and customers alike. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but upstream changeset 3656358 confirms a fix has been committed.
The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.3.26. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.7.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated cross-site scripting in the WordPress eCommerce Product Catalog plugin, affecting versions up to and including 3.6.5, allows remote attackers to inject script that executes in a victim's browser when that user loads or interacts with attacker-influenced content. The issue is rated CVSS 3.1 7.1 and requires user interaction (UI:R); no public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Reflected cross-site scripting (CWE-79) in the impleCode eCommerce Product Catalog WordPress plugin through version 3.6.4 allows a remote, unauthenticated attacker to run script in a victim's browser by persuading the victim to open a crafted URL that reflects an unsanitized input. Exploitation is constrained by the required victim interaction (UI:R) and the fact that the payload is not stored, so each target has to be lured individually; no public exploit code or proof-of-concept is referenced in the available intelligence, and the case is queued for handling this week under the vuln.today priority. No vendor-released fixed version is identified in the supplied data, and the advisory of record is the Patchstack database entry.
PHP object injection in the Implecode eCommerce Product Catalog plugin for WordPress (3.6.0 and earlier) allows an authenticated attacker holding a high-privilege custom role to feed crafted serialized data into PHP's unserialize(), enabling arbitrary object instantiation that can escalate to remote code execution where a usable POP gadget chain exists in loaded code. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), it carries full confidentiality, integrity and availability impact, but is access-gated: the high-privilege custom role requirement (PR:H) means anonymous and low-privileged users cannot reach the vulnerable path, so this is a genuine but access-gated risk rather than an internet-wide exposure. No public exploit identified at time of analysis.
Cross-site scripting in the implecode eCommerce Product Catalog WordPress plugin (all versions through 3.5.4) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser session, with no login required (PR:N) but a user interaction step to trigger the payload (UI:R). Reported by Patchstack and rated CVSS 7.1, the scope-changing flaw can hijack administrator or shopper sessions on affected online stores. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a plausible-impact issue rather than a confirmed active-exploitation event.
Unauthenticated SQL injection in the implecode eCommerce Product Catalog WordPress plugin (versions 3.5.5 and earlier) allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 9.3 score reflects a scope change with high confidentiality impact, meaning data outside the plugin's database context can be reached. No public exploit identified at time of analysis, though the Patchstack advisory confirms the vendor-tracked vulnerability class.
Stored cross-site scripting in impleCode's eCommerce Product Catalog plugin for WordPress (versions through 3.6.2) allows an authenticated user holding only low-level privileges to plant malicious JavaScript in catalog content, which then executes in the browser of any user - typically an administrator - who views the affected catalog page. The issue is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and the available intelligence shows no public exploit identified at time of analysis and no vendor-released patch version confirmed in the provided data. Real-world risk is constrained because the attacker needs some authenticated role on the target site and must wait for a victim to load the poisoned page, and the plugin has to be installed and active - it is a niche e-commerce plugin rather than a default WordPress component.
Stored XSS in the eCommerce Product Catalog WordPress plugin (≤3.5.10) by implecode allows any authenticated contributor to persist malicious JavaScript via the 'style' shortcode attribute, bypassing WordPress's save-time wp_kses_post sanitization because the payload is stored inside shortcode brackets containing no HTML tags, with dangerous markup generated only at render time by the shortcode handler. Every subsequent visitor to an injected page executes the attacker's script in their browser context, enabling session hijacking, credential theft, or malicious redirects against administrators and customers alike. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but upstream changeset 3656358 confirms a fix has been committed.
The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.3.26. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.7.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.