WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

CVE-2026-105056

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

CVE-2026-105056

The impleCode eCommerce Product Catalog plugin for WordPress versions up to and including 3.6.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This vulnerability stems from the improper neutralization of input during web page generation . An attacker could potentially execute maliciou...

EUVD-2026-92317

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

CVE-2026-105056 WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

CVE-2026-105056 WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin eCommerce Product Catalog versions = 3.6.2...

PT-2026-104778

Name of the Vulnerable Software and Affected Versions eCommerce Product Catalog versions prior to 3.6.3 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the target serv...

CVE-2026-105056: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

CVE-2026-96344

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

EUVD-2026-89857

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344

The eCommerce Product Catalog plugin for WordPress (versions

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344: Deserialization of Untrusted Data

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

PT-2026-103189

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin eCommerce Product Catalog versions = 3.6.0...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...