Description
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.
Published: 2026-07-02
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WordPress eCommerce Product Catalog plugin contains an unauthenticated Cross Site Scripting (XSS) vulnerability in all versions up to and including 3.5.4. The flaw allows malicious scripts to be injected into the plugin’s output, which could be executed by visitors who view affected catalog pages.

Affected Systems

WordPress sites that have the impleCode eCommerce Product Catalog plugin version 3.5.4 or older are affected. Plugins 3.5.5 and newer contain the fix. No other plugins or vendors are listed in the CNA data.

Risk and Exploitability

The CVSS base score of 7.1 indicates high severity. The EPSS score of less than 1% raises the likelihood that the flaw will be exploited in practice. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits. The CVE states this is an unauthenticated XSS flaw, meaning the attack does not require user authentication on the site.

Generated by OpenCVE AI on July 15, 2026 at 09:49 UTC.

Remediation

Vendor Solution

Update the WordPress eCommerce Product Catalog Plugin to the latest available version (at least 3.5.5).

OpenCVE Recommended Actions

  • Upgrade the WordPress eCommerce Product Catalog plugin to version 3.5.5 or later to remove the XSS flaw.
  • If an update is not possible, disable or uninstall the plugin to eliminate the vulnerable functionality.
  • Apply input validation or output escaping to any custom code that displays catalog content, following CWE‑79 best practices.

Generated by OpenCVE AI on July 15, 2026 at 09:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Implecode
Implecode ecommerce Product Catalog
Wordpress
Wordpress wordpress
Vendors & Products Implecode
Implecode ecommerce Product Catalog
Wordpress
Wordpress wordpress

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.
Title WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Implecode Ecommerce Product Catalog
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-02T14:32:52.699Z

Reserved: 2026-06-24T12:45:36.889Z

Link: CVE-2026-57360

cve-icon Vulnrichment

Updated: 2026-07-02T14:32:49.647Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-15T10:00:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')