A Cross-site Scripting vulnerability in the eCommerce Product Catalog plugin for WordPress allows Stored XSS, affecting versions from n/a through 3.6.2. This issue enables attackers to inject malicious scripts, potentially leading to unauthorized actions or data manipulation. Defenders should assess exposure and prioritize patching or mitigation efforts to prevent potential security risks. The vulnerabili [truncated]
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to, and including, 3.5.10. This is due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
CVE-2026-52693 is a critical vulnerability with a CVSS score of 9.3, indicating a high severity. It is an unauthenticated SQL injection vulnerability in the eCommerce Product Catalog plugin versions <= 3.5.5.
