Is CVE-2021-47924 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-47924 being exploited in the wild.

How severe is CVE-2021-47924?

Medium severity, with a CVSS score of 6.4, published 10 May 2026.

Which products and versions are affected?

Etoile Web Design Ultimate Product Catalog <= 5.8.2.

Is there a fix for CVE-2021-47924?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-47924 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-47924?

Check whether you run Etoile Web Design Ultimate Product Catalog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47924: Etoile Web Design Ultimate Product Catalog stored XSS in price parameter

Q: Is there a fix for CVE-2021-47924?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2021-47924 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2021-47924?

Check whether you run Etoile Web Design Ultimate Product Catalog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47924 · Severity: medium · CVSS 6.4 · Published 2026-05-10

The Ultimate Product Catalog plugin for WordPress, used to display and manage product listings, contains a security flaw that allows users with basic account access to inject malicious scripts. By submitting a specially crafted price value for a product, an attacker can execute code in the browsers of other users, including administrators, who view that product. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.

Vendors: Etoile Web Design.

Quick answers

Is CVE-2021-47924 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-47924 being exploited in the wild.
How severe is CVE-2021-47924?: Medium severity, with a CVSS score of 6.4, published 10 May 2026.
Which products and versions are affected?: Etoile Web Design Ultimate Product Catalog <= 5.8.2.
Is there a fix for CVE-2021-47924?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-47924 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-47924?: Check whether you run Etoile Web Design Ultimate Product Catalog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Ultimate Product Catalog plugin (version 5.8.2 and earlier) for WordPress. The flaw is located in the handling of the 'price' parameter within the product creation/editing functionality. An authenticated attacker can submit a POST request to 'post.php' containing a malicious HTML or JavaScript payload in the price field. Because the plugin fails to properly sanitize this input before storing it in the database and subsequently rendering it on the page, the script executes in the context of any user who views the affected product. This can be used to hijack administrative sessions or perform unauthorized site modifications.

Affected products

Etoile Web Design (Rustaurius) Ultimate Product Catalog <= 5.8.2

Timeline

2021-11-18: other: Exploit-DB proof of concept published
2026-05-10: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.