Ultimate Product Catalog 5.8.2 contains a stored cross‑site scripting flaw that allows an authenticated user to inject arbitrary HTML or JavaScript into the price field. By sending a crafted POST request to the plugin’s post.php endpoint, the malicious payload is stored with the product. When any visitor loads the product page, the embedded script executes in the visitor’s browser, potentially enabling actions such as cookie theft, session hijacking, or navigation to malicious sites.

WordPress installations that have installed Etoilewebdesign’s Ultimate Product Catalog plugin version 5.8.2 and that permit users to edit product prices are vulnerable. The flaw exists only in this specific version and depends on the plugin’s lack of sanitization for the price input.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated account with permission to edit product prices and the ability to submit a POST request to post.php. Once the payload is stored, it executes each time the product page is viewed by any user.