CVE-2023-47839

CVE-2023-47839 affects the WordPress plugin eCommerce Product Catalog (

CVE-2023-51688

CVE-2023-51688 affects the eCommerce Product Catalog Plugin for WordPress by impleCode. The vulnerability is described as Exposure of Sensitive Information to an Unauthorized Actor, specifically via CSV file exposure for versions up to 3.3.26. Wordfence indicates the issue is real and has a patch...

CVE-2021-24875

The CVE-2021-24875 entry concerns the WordPress plugin “eCommerce Product Catalog” (for WordPress) prior to version 3.0.39. Affected functionality is the ic-settings-search parameter not being escaped when echoed into an HTML attribute, causing a Reflected Cross-Site Scripting (XSS) vulnerability...

CVE-2021-4393

The CVE-2021-4393 entry concerns the eCommerce Product Catalog Plugin for WordPress, where a Cross-Site Request Forgery flaw stems from missing/incorrect nonce validation in the plugin’s save() function. Affected are versions up to 3.0.17. This allows unauthenticated attackers to forge requests t...

CVE-2023-25049

CVE-2023-25049 affects the WordPress plugin “impleCode eCommerce Product Catalog Plugin for WordPress” (versions ≤ 3.3.4). The vulnerability is an authenticated (admin+) Stored Cross-Site Scripting (XSS) issue. Public sources in connected documents consistently describe the flaw as an XSS due to ...

CVE-2021-4392

CVE-2021-4392 affects the WordPress plugin “eCommerce Product Catalog” (versions up to and including 2.9.43). Root cause: missing or incorrect nonce validation in the implecode_save_products_meta() function, enabling CSRF. Impact: unauthenticated attackers can save product meta data by tricking a...

CVE-2023-5979

CVE-2023-5979 affects the WordPress plugin eCommerce Product Catalog (versions before 3.3.26). The root cause is missing CSRF checks in some admin pages, which could let an attacker cause logged-in users to perform unwanted actions, such as deleting all products. Impact is stated as CSRF-enabled ...

CVE-2023-1470

CVE-2023-1470 affects the WordPress plugin “eCommerce Product Catalog” up to version 3.3.8. The root cause is insufficient input sanitization and output escaping in certain settings parameters, enabling a stored cross-site scripting (XSS) attack. Exploitation requires authenticated access with ad...