CVE-2026-76128: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in implecode eCommerce Product Catalog

CVE-2026-76128 is a stored cross-site scripting vulnerability in the implecode eCommerce Product Catalog WordPress plugin, affecting versions up to 3.5.10. The flaw exists in the 'style' shortcode attribute, where insufficient input sanitization and output escaping allow authenticated contributors and above to inject arbitrary scripts. These scripts are stored in shortcode brackets, bypassing WordPress's save-time wp_kses_post sanitization since no HTML tags are present at that stage. The malicious scripts execute at render time when the shortcode handler generates the tainted HTML output.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or user session compromise. The vulnerability does not affect availability and requires authenticated access, but it can compromise confidentiality and integrity of user interactions.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected shortcode functionality if feasible.