The Product Catalog Simple plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the show_products shortcode does not adequately sanitize or escape user-supplied attributes, enabling authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of any user who accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.7.11. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the show_products shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially allowing theft of user credentials, session tokens, or other malicious actions limited to the scope of the injected script. The vulnerability does not affect availability and requires authenticated access, limiting its impact to confidentiality and integrity within the affected WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Product Catalog Simple plugin if feasible. Monitor official vendor channels for updates or patches addressing this vulnerability.