CVE-2026-79621: CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using the CatalogX WordPress plugin at a version earlier than 6.1.3 are affected. The issue can be triggered without authentication.
What must happen for injected content to reach an administrator?
An attacker must first store content through the affected unauthenticated functionality. The content is included in the product enquiry notification only when an unrelated visitor later submits a product enquiry.
What is the impact of successful exploitation?
An attacker can inject arbitrary content into the product enquiry notification email delivered to the site administrator. The provided information does not indicate that the attacker gains WordPress account access or code execution.