Where
-Infinity
0

Trending

Last week
Last month
Last year

impleCode eCommerce Product CatalogWordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection Vulnerability

Risk 49
Severity
7.2
EPSS
0.04%
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog allows Object Injection. This issue affects eCommerce Product Catalog: from n/a through 3.4.3.

1 / 2
Source: NVD

Remedy

Update the WordPress eCommerce Product Catalog plugin to the latest available version (at least 3.4.4).
First published (updated )
CVE-2025-49331

impleCode eCommerce Product CatalogWordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Risk 66
Severity
7.2
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

First published (updated )
CVE-2026-96344

impleCode eCommerce Product CatalogWordPress eCommerce Product Catalog plugin <= 3.3.32 - Cross Site Scripting (XSS) vulnerability

Risk 36
Severity
7.1
EPSS
0.04%
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.3.32.

Remedy

Update to 3.3.33 or a higher version.
First published (updated )
CVE-2024-32558

impleCode Ecommerce Product Catalog WordpresseCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF

Risk 27
Severity
6.5
EPSS
0.05%
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products

First published (updated )
CVE-2023-5979

impleCode Ecommerce Product Catalog WordpresseCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue

First published (updated )
CVE-2021-24875

impleCode eCommerce Product CatalogWordPress eCommerce Product Catalog plugin <= 3.3.28 - Cross Site Request Forgery (CSRF) vulnerability

Risk 16
Severity
4.3
EPSS
0.04%
CSRF
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Cross-Site Request Forgery (CSRF) vulnerability in impleCode eCommerce Product Catalog.This issue affects eCommerce Product Catalog: from n/a through 3.3.28.

Remedy

Update to 3.3.29 or a higher version.
First published (updated )
CVE-2024-32437

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203