The vendor‑supplied product catalog plugin accepts unsanitized input that is rendered within the web page, enabling Stored XSS attacks. This flaw corresponds to CWE‑79 and allows an attacker to inject malicious scripts into catalog entries or product descriptions. Once executed in a victim’s browser, the injected code can steal session cookies, deface the site, or redirect users to malicious sites, thereby compromising confidentiality, integrity, and potentially availability of the affected site’s administrative functions.

The impact covers all releases of the impleCode eCommerce Product Catalog plugin from the earliest available build up to and including version 3.6.2. Any WordPress installation that has these plugin versions installed and configured is potentially vulnerable.

The CVSS score of 6.5 rates the exploit as high‑impact, and while an EPSS score is not available, the absence of KEV listing indicates no known active exploitation yet. The likely attack path requires an attacker to insert malicious content into a catalog entry, which generally demands authenticated access to administrate product listings, but once injected the payload can affect any visitor. Accordingly, the risk is moderate to high depending on the site’s exposure and the level of public access to the catalog.