CVE-2026-105056
Received Received - Intake

Stored XSS in eCommerce Product Catalog Plugin

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105056
EUVD
EUVD-2026-92317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
implecode ecommerce_product_catalog to 3.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the impleCode eCommerce Product Catalog plugin. It allows attackers to inject malicious scripts into web pages that are then stored and served to other users. The flaw exists due to improper neutralization of user input during web page generation.

Detection Guidance

To detect this stored XSS vulnerability in the eCommerce Product Catalog plugin, inspect web application logs for suspicious input patterns, particularly in product descriptions or other user-supplied fields. Check for JavaScript code snippets or HTML tags in stored data that could indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to steal user sessions, redirect users to malicious sites, or perform actions on behalf of users. It may lead to unauthorized data access, defacement of web pages, or spreading malware to visitors of the affected site.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data. Under GDPR, this may result in fines for insufficient technical measures. For HIPAA, it could violate safeguards for protected health information, risking penalties.

Mitigation Strategies

Immediately update the eCommerce Product Catalog plugin to version 3.6.2 or later. If an update is unavailable, disable the plugin temporarily. Implement input validation and output encoding for all user-supplied data. Review stored data for signs of compromise and remove any malicious scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart