CVE-2026-115596: WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vector is network-based, no prior privileges are required, and exploitation requires user interaction. An attacker would need to induce a user to interact with a crafted request or page containing the reflected payload.

Q: Which plugin versions are affected?

The affected range is reported as eCommerce Product Catalog versions through 3.6.4. The available data does not identify a fixed version.

Q: What is the potential impact if exploitation succeeds?

The reported severity is High with a 7.1 score. The CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

Published Oct 28, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.

Affected Software

1 affected component

impleCode eCommerce Product Catalog<=3.6.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ecommerce-product-catalog to a version that resolves this vulnerability.
Fixed in 3.6.5

Event History

Oct 28, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vector is network-based, no prior privileges are required, and exploitation requires user interaction. An attacker would need to induce a user to interact with a crafted request or page containing the reflected payload.

Which plugin versions are affected?

The affected range is reported as eCommerce Product Catalog versions through 3.6.4. The available data does not identify a fixed version.

What is the potential impact if exploitation succeeds?

The reported severity is High with a 7.1 score. The CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

CVE-2026-115596: WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the potential impact if exploitation succeeds?