The WordPress eCommerce Product Catalog plugin up to version 3.5.4 contains an unauthenticated Cross Site Scripting vulnerability (CWE‑79). A malicious actor can supply crafted input through the plugin’s catalog pages or configuration fields, causing the web application to serve unsanitized script content to visitors. This flaw enables arbitrary JavaScript execution in the browsers of anyone who views an affected page, potentially leading to cookie theft, session hijacking, or defacement of the site.

WordPress sites that use the impleCode eCommerce Product Catalog plugin version 3.5.4 or earlier are at risk. Later releases, starting with 3.5.5, contain the fix. No other plugins or vendors are listed in the CNA data.

The CVSS score of 7.1 reflects a high severity for the XSS flaw. The EPSS score of less than 1% indicates that active exploitation, if it occurs, is presently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Because authentication is not required, an attacker can craft malicious input via publicly accessible URLs or plugin forms, leading to client‑side script execution for any site visitor.