Live › vulnerability › CVE-2026-115596
Go to dashboardThe eCommerce Product Catalog WordPress plugin by impleCode does not neutralize input when generating web pages, allowing reflected cross-site scripting. An attacker can get a script to run in a visitor's browser, for example to steal a logged-in admin session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites running the eCommerce Product Catalog plugin (slug ecommerce-product-catalog) at version 3.6.4 or older are exposed. Sites without the plugin installed, or running a newer release, can skip it. The sources do not say which page or parameter is reflected.
No product ranges from the sources yet.
wp plugin get ecommerce-product-catalog --field=version3.6.4, or remove the plugin if unusedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-115596")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.