CVE-2026-116851 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting eCommerce Product Catalog versions up to and including 3.6.5. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of users' browsers without requiring authentication.