Improper Neutralization of Input During Web Page Generation, known as a Cross-Site Scripting flaw, exists in the impleCode eCommerce Product Catalog plugin. An attacker can embed malicious JavaScript in a request that the plugin reflects back into its output, allowing the script to execute in the victim’s browser when the page loads. Because the flaw is client‑side and reflected, it foregrounds risks such as unauthorized script execution but does not permit direct server‑side compromise.

This issue affects the WordPress eCommerce Product Catalog plugin from impleCode, specifically all releases up through version 3.6.4. Any WordPress site that is running one of these vulnerable versions and is accepting user‑supplied input that the plugin displays is at risk.

The CVSS score of 7.1 signals a high‑severity vulnerability. The EPSS score is not available, so the frequency of real‑world exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack pathway requires an attacker to craft a request or provide a malicious link that the vulnerable plugin will reflect back into a page. Only users who view the malformed page or interact with the affected input will be impacted, and the flaw does not provide remote code execution for the server.