{"id":"CVE-2026-116851","kind":"vulnerability","aliases":["CVE-2026-116851"],"related":[],"title":"eCommerce Product Catalog WordPress plugin: unauthenticated cross-site scripting flaw","description":"Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.","summary":"The eCommerce Product Catalog plugin for WordPress, versions up to and including 3.6.5, has an unauthenticated cross-site scripting flaw. An attacker can get malicious script to run in a visitor's browser, such as an administrator's session on the site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the eCommerce Product Catalog plugin in the WordPress admin under Plugins.\n- Compare the version against `3.6.5`; versions up to and including `3.6.5` are listed as affected.","fix":"- eCommerce Product Catalog plugin: a fixed version newer than `3.6.5` is implied by the affected range; the exact patched version is unknown from the sources.","status":"open","published_at":"2026-10-30T19:18:14+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:07+00:00","updated_at":"2026-10-30T19:26:07+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:07Z","model":"claude-haiku-5-5","output":{"fix":"- eCommerce Product Catalog plugin: a fixed version newer than `3.6.5` is implied by the affected range; the exact patched version is unknown from the sources.","reach":"internet","title":"eCommerce Product Catalog WordPress plugin: unauthenticated cross-site scripting flaw","impact":"medium","summary":"The eCommerce Product Catalog plugin for WordPress, versions up to and including 3.6.5, has an unauthenticated cross-site scripting flaw. An attacker can get malicious script to run in a visitor's browser, such as an administrator's session on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ecommerce","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers, possibly admin sessions.","analyst_note":"Confirm the vulnerable input, the fixed plugin version and whether admin-facing pages are affected, using https://nvd.nist.gov/vuln/detail/CVE-2026-116851 and the plugin's changelog.","how_to_check":"- Check the installed version of the eCommerce Product Catalog plugin in the WordPress admin under Plugins.\n- Compare the version against `3.6.5`; versions up to and including `3.6.5` are listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the eCommerce Product Catalog WordPress plugin at version 3.6.5 or older are exposed. The sources do not say which page or input is vulnerable, so sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4076,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116851':14A,17A '-2026':13A,16A '3.6.5':34B,74C 'administr':59B 'attack':44B 'browser':55B 'catalog':3A,25B,73C 'cross':8A,39B,66C 'cross-sit':7A,38B 'cve':12A,15A 'ecommerc':1A,18B,23B,71C 'flaw':11A,42B 'get':46B 'includ':33B 'malici':47B 'packag':19B 'php':20B 'plugin':5A,26B 'product':2A,24B,72C 'run':50B 'script':10A,41B,48B,68C 'session':61B 'site':9A,40B,64B,67C 'unauthent':6A,37B,65C 'version':29B,75C 'visitor':53B 'wordpress':4A,21B,28B 'xss':69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the eCommerce Product Catalog WordPress plugin at version 3.6.5 or older are exposed. The sources do not say which page or input is vulnerable, so sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116851","severity":null,"published_at":"2026-10-30T19:18:14+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}