CVE-2026-76128 in eCommerce Product Catalog Plugin
Summary
by MITRE • 08/25/2026
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags; the tainted HTML output is only generated at render time by the shortcode handler.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in the eCommerce Product Catalog plugin for WordPress, affecting versions up to and including 3.5.10, represents a significant security risk rooted in insufficient input sanitization and lack of proper output escaping within the 'style' Shortcode Attribute. This flaw allows authenticated attackers who possess contributor-level access or higher privileges to inject arbitrary web scripts into product catalog pages. The core technical issue lies in how the plugin processes shortcode attributes during both storage and rendering phases. Unlike standard HTML content that is typically sanitized at save time using WordPress's built-in wp_kses_post function, this vulnerability exploits a gap where malicious payloads are stored inside shortcode brackets without immediate HTML tag interpretation. Consequently, the sanitization mechanisms do not trigger or apply effectively to these specific inputs because they appear as plain text within the shortcode structure rather than as rendered markup during the initial save operation.
The operational impact of this Stored Cross-Site Scripting vulnerability is severe due to its persistence and broad execution scope. Once an attacker successfully injects a malicious script via the style attribute, that payload becomes permanently stored in the database associated with specific product entries or catalog configurations. When any user subsequently accesses these pages, the plugin's shortcode handler processes the input at render time, generating tainted HTML output that executes the injected JavaScript within the victim's browser context. This execution occurs without further validation, allowing the attacker to perform actions such as stealing session cookies, hijacking administrative sessions, defacing websites, or redirecting users to malicious external sites. The requirement for contributor-level access lowers the barrier for exploitation compared to vulnerabilities requiring administrator privileges, thereby increasing the attack surface within typical WordPress environments where multiple user roles exist.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the subcategory of Stored XSS because the malicious script is persistently stored on the target server and served to other users upon request. In terms of adversary tactics, this exploitation technique corresponds to ATT&CK Tactic TA0005 Defense Evasion and specifically Technique T1189 Drive-by Client Side Script Injection or potentially T1059 Command and Control if used for beaconing, though primarily it serves the objective of Initial Access via compromised credentials leading to persistent code execution. The bypass of wp_kses_post highlights a common pitfall in plugin development where developers assume that standard sanitization functions cover all input vectors, failing to account for dynamic rendering contexts inherent in shortcode architectures.
To mitigate this vulnerability, immediate action is required by updating the eCommerce Product Catalog plugin to version 3.5.11 or later, which addresses these specific sanitization and escaping deficiencies. For organizations unable to update immediately due to compatibility constraints, temporary mitigations should include restricting contributor-level access to trusted individuals only and implementing a Web Application Firewall that can detect and block XSS payloads in shortcode attributes. Additionally, developers reviewing similar plugins should ensure that all dynamic content generated by shortcodes is explicitly escaped using appropriate WordPress functions such as esc_attr or esc_html before outputting data into HTML contexts. It is also critical to implement strict input validation at the point of entry for any attribute values processed by shortcodes, ensuring that even if stored safely, they are sanitized again during rendering to prevent execution of unintended scripts. Regular security audits and code reviews focusing on shortcode handlers can help identify similar architectural flaws before they are exploited in production environments.