impleCode vulnerabilities

Products

• eCommerce Product Catalog 18
• eCommerce Product Catalog Plugin for WordPress 7
• Product Catalog Simple 7
• reviews plus 2

Latest impleCode CVEs

Newest publication first · page 2 of 2

1. CVE-2023-1470 eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

   Published 2023-03-17

   Medium·CVSS 4.8 EPSS 0.38%

   The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

2. CVE-2021-24894 Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS

   Published 2021-11-23

   Medium·CVSS 6.5 EPSS 1.5%

   The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page

3. CVE-2021-24875 eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting

   Published 2021-11-23

   Medium·CVSS 6.1 EPSS 1.7%

   The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.