CVE-2026-57360: eCommerce Product Catalog XSS Vulnerability

CVE-2026-57360 Overview

CVE-2026-57360 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the eCommerce Product Catalog plugin for WordPress in versions up to and including 3.5.4. The flaw is classified under [CWE-79], improper neutralization of input during web page generation. An attacker can inject malicious JavaScript into a vulnerable parameter, which executes in the browser of any user who interacts with a crafted link or page. Because the attack requires no authentication and can be delivered over the network, exposure spans any WordPress site running the affected plugin version.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and administrative account takeover on WordPress sites running the vulnerable plugin.

Affected Products

eCommerce Product Catalog plugin for WordPress, versions <= 3.5.4
WordPress installations with the plugin activated and reachable from the internet
Any downstream site inheriting the vulnerable plugin through multisite or shared hosting deployments

Discovery Timeline

2026-07-02 - CVE-2026-57360 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57360

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting flaw in the eCommerce Product Catalog WordPress plugin. The plugin fails to properly neutralize user-controllable input before returning it in HTML output. When an attacker supplies a crafted payload containing HTML or JavaScript, the plugin renders that payload directly into the response body without adequate encoding or sanitization.

Exploitation requires user interaction, typically clicking a malicious link or visiting an attacker-controlled page that triggers the request. Because the scope is changed, the injected script executes in the security context of the vulnerable WordPress site. Successful exploitation can compromise site visitors, harvest authenticated session cookies, or pivot to administrator accounts if a logged-in admin views the payload.

Root Cause

The root cause is missing or insufficient output encoding on user-supplied parameters processed by the plugin. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses() for context-aware sanitization. The affected plugin code paths in versions up to 3.5.4 do not apply these consistently before echoing input into the DOM, allowing attacker-controlled markup to be interpreted as executable script.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker crafts a URL or form submission targeting the vulnerable plugin endpoint and lures a victim into loading it. Delivery mechanisms include phishing emails, malicious ads, social media links, or attacker-controlled sites that auto-submit requests. On execution, the payload runs with the privileges of the victim's browser session against the affected WordPress origin. Refer to the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2026-57360

Indicators of Compromise

Web server access logs containing plugin request parameters with <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Unexpected outbound requests from admin browsers to unfamiliar domains shortly after visiting product catalog pages.
New or modified WordPress administrator accounts, plugins, or theme files following user interaction with plugin URLs.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that flags XSS payload signatures in query strings and POST bodies targeting eCommerce Product Catalog endpoints.
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts against the WordPress origin.
Review plugin request telemetry for repeat requests from the same source containing encoded HTML metacharacters.

Monitoring Recommendations

Alert on WordPress wp-admin session activity originating from unusual geolocations or user agents after users visit product catalog pages.
Monitor plugin file integrity and the wp_users table for unauthorized changes indicative of post-XSS account takeover.
Correlate reverse proxy logs with WordPress audit logs to identify reflected payloads that returned HTTP 200 responses.

How to Mitigate CVE-2026-57360

Immediate Actions Required

Update the eCommerce Product Catalog plugin to a version newer than 3.5.4 as soon as the vendor releases a patched release.
Temporarily deactivate the plugin on production sites if a patched version is not yet available and the catalog is not business-critical.
Force logout of all WordPress administrator sessions and rotate credentials for privileged accounts.

Patch Information

Consult the Patchstack XSS Vulnerability Advisory for the latest fixed version and vendor guidance. Apply plugin updates through the WordPress admin dashboard or via wp-cli using wp plugin update ecommerce-product-catalog.

Workarounds

Restrict access to WordPress admin paths using IP allowlists at the reverse proxy or WAF layer.
Deploy virtual patching rules in a WAF to block requests containing HTML tags or JavaScript event handlers in plugin parameters.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce payload execution success.

bash

# Update the vulnerable plugin using wp-cli
wp plugin update ecommerce-product-catalog
wp plugin list --name=ecommerce-product-catalog --fields=name,status,version