Live › vulnerability › CVE-2026-116851
The eCommerce Product Catalog plugin for WordPress, versions up to and including 3.6.5, has an unauthenticated cross-site scripting flaw. An attacker can get malicious script to run in a visitor's browser, such as an administrator's session on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the eCommerce Product Catalog WordPress plugin at version 3.6.5 or older are exposed. The sources do not say which page or input is vulnerable, so sites without this plugin can skip it.
No product ranges from the sources yet.
3.6.5; versions up to and including 3.6.5 are listed as affected.3.6.5 is implied by the affected range; the exact patched version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116851")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.