Executive brief
The Ultimate Product Catalog plugin for WordPress, used to display and manage product listings, contains a security flaw that allows users with basic account access to inject malicious scripts. By submitting a specially crafted price value for a product, an attacker can execute code in the browsers of other users, including administrators, who view that product. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Ultimate Product Catalog plugin (version 5.8.2 and earlier) for WordPress. The flaw is located in the handling of the 'price' parameter within the product creation/editing functionality. An authenticated attacker can submit a POST request to 'post.php' containing a malicious HTML or JavaScript payload in the price field. Because the plugin fails to properly sanitize this input before storing it in the database and subsequently rendering it on the page, the script executes in the context of any user who views the affected product. This can be used to hijack administrative sessions or perform unauthorized site modifications.
Affected products
- Etoile Web Design (Rustaurius) Ultimate Product Catalog <= 5.8.2
Timeline
- 2021-11-18: other: Exploit-DB proof of concept published
- 2026-05-10: advisory: NVD/VulnCheck advisory published