CVE-2021-24875: eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-23 · updated 2026-06-17
Weakness: CWE-79

Description

The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue

Affected products

impleCode eCommerce Product Catalog: before 3.0.39 — fixed in 3.0.39

How to fix

Upgrade to a fixed version: impleCode eCommerce Product Catalog 3.0.39. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715
https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715

Get alerted when CVE-2021-24875 or the next vulnerability affects your stack