CVE-2026-115596: XSS in eCommerce Product Catalog Plugin

CVE-2026-115596 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress eCommerce Product Catalog plugin by impleCode. The flaw allows injection of malicious code into dynamically generated pages, affecting online stores and eCommerce platforms using the plugin through version 3.6.4. An attacker can exploit this weakness to steal session data, credentials, or sensitive information from customers and administrators.

The CVSS score is 7.1, classified as HIGH severity. The vulnerability was made public on GitHub on November 7, 2026, with proof-of-concept claimed as available. This public visibility accelerates the risk of active exploitation. The reflected nature of the vulnerability requires user interaction (click on malicious link), but the potential damage remains significant on eCommerce sites with high traffic and exposed customer base.

WordPress site administrators must immediately update the eCommerce Product Catalog plugin to a version beyond 3.6.4. While awaiting a patch, deploy Web Application Firewall (WAF) rules to filter suspicious input on catalog pages; review and strengthen input sanitization rules in the codebase. Monitor access logs for signs of XSS attempts and audit all plugin extensions for other input validation vulnerabilities.