eCommerce Product Catalog vulnerabilities | LiveThreat CVE Feed

Product

eCommerce Product Catalog

by implecode · last CVE Oct 28, 2026

CVEs

On KEV

9.3

Max CVSS

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 1High 4Medium 9Low 0

Severity

All severities14 Critical1 High4 Medium9 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add eCommerce Product Catalog to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-52693	9.3	0%	Jun 15	WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability Affected: through 3.5.5
CVE-2023-51688	7.5	0%	Dec 29	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog… Affected: before 3.3.27
CVE-2026-96344	7.2	0%	Sep 30	WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability Affected: through 3.6.0
CVE-2026-115596 New	7.1	–	Oct 28	WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability Affected: through 3.6.4
CVE-2026-57360	7.1	0%	Jul 2	WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability Affected: through 3.5.4
CVE-2026-105056	6.5	0%	Oct 5	WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability Affected: through 3.6.2
CVE-2023-5979	6.5	0%	Dec 4	The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users… Affected: before 3.3.26
CVE-2026-76128	6.4	0%	Aug 25	eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute Affected: through 3.5.10
CVE-2021-24875	6.1	2%	Nov 23	The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute,… Affected: before 3.0.39
CVE-2023-47839	5.4	0%	Nov 23	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26… Affected: through 3.3.26
CVE-2023-25049	4.8	0%	Apr 7	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 versions Affected: through 3.3.4
CVE-2023-1470	4.8	0%	Mar 17	The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to… Affected: before 3.3.9
CVE-2021-4393	4.3	0%	Jul 1	The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17 Affected: before 3.0.18
CVE-2021-4392	4.3	0%	Jul 1	The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43 Affected: through 2.9.43