CVE-2026-57360

Name of the Vulnerable Software and Affected Versions eCommerce Product Catalog versions prior to 3.5.5

Description The eCommerce Product Catalog Plugin for WordPress is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically whenever a user accesses the affected page.

Recommendations Update the plugin to a version newer than 3.5.4.