The eCommerce Product Catalog plugin for WordPress contains an unauthenticated Cross Site Scripting vulnerability that allows an attacker to inject arbitrary client‑side scripts into pages rendered by the plugin. This flaw occurs because user‑controlled content is not properly sanitized.

Any WordPress site that has the impleCode eCommerce Product Catalog plugin installed in a version up to and including 3.6.5 is affected. These versions lack necessary sanitization when rendering user‑controlled content from the plugin’s catalog pages.

The CVSS score of 7.1 indicates a medium to high likelihood of serious impact if exploited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known exploit has been publicly observed yet. Because the flaw is unauthenticated and operates via normal browser requests, any visitor to a page that displays affected content can potentially trigger the injected script, making the threat surface broad and easy to use for attackers.