CVE-2023-2711

The CVE-2023-2711 entry concerns the Ultimate Product Catalog WordPress plugin (prior to 5.2.6). The vulnerability arises because some settings are not properly sanitised/escaped, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (including multisi...

CVE-2021-24993

The Ultimate Product Catalog WordPress plugin is affected pre-5.0.26 by missing authorization and CSRF checks in certain AJAX actions, allowing any authenticated user (e.g., a subscriber) to add arbitrary products or alter settings. Mitigation: update to version 5.0.26 or later; a PoC exists show...