The eCommerce Product Catalog plugin for WordPress is vulnerable to stored XSS through the 'style' attribute of its shortcode. The flaw arises because input from contributors is stored without proper sanitization and is later rendered when the page is displayed. An authenticated attacker with contributor or higher privileges can embed malicious scripts that will run in any user’s browser upon viewing the infected page. This leads to potential cookie theft, credential compromise, defacement, or the execution of arbitrary code by the user context. The vulnerability is a classic CWE‑79, Cross‑Site Scripting.

All instances of the WordPress plugin eCommerce Product Catalog by implecode, from version 1.0 through 3.5.10, are affected. Any WordPress site that has installed these versions, regardless of WordPress core version, is at risk. The bug exists in all builds up to and including 3.5.10; newer releases have the patch applied.

The CVSS base score of 6.4 indicates a medium‑high severity, and the vulnerability is exploitable only after an attacker gains contributor‑level access. Because the exploit is stored, an attacker can launch a one‑click attack after embedding the payload, and the malicious code runs in the context of any visitor who loads the page. No public exploit is listed in KEV, and EPSS data is unavailable, so the exact exploitation probability is unknown, but the presence of this vulnerability and the requirement of contributor permissions makes it a priority for remediation. The blind probability of exploitation remains moderate; if multiple contributors are present, the risk escalates.