CVE-2026-76128

Name of the Vulnerable Software and Affected Versions eCommerce Product Catalog versions prior to 3.5.11

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages using the style attribute of a shortcode. The malicious content bypasses the wp kses post sanitization process during saving because it is stored within shortcode brackets without HTML tags; the tainted HTML is only generated when the shortcode handler renders the page.

Recommendations Update eCommerce Product Catalog to version 3.5.11 or later. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the style attribute within shortcodes.