Vulnerabilities

TI-2025-01208 CVE-2025-1405 · GHSA-jc5x-gpwr-cjq7

Product Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode

LOW 28

The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00292 Published 2025-02-28 No fix listed CWE-79

TI-2023-28333 CVE-2023-51687 · GHSA-j7cq-cc9w-27rj

WordPress Product Catalog Simple Plugin <= 1.7.6 is vulnerable to Sensitive Data Exposure

LOW 33

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/a through 1.7.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0048 Published 2023-12-29 No fix listed CWE-200

TI-2020-18912 CVE-2020-36743 · GHSA-hrmj-mxq5-4f7c

Product Catalog Simple <= 1.5.13 - Cross-Site Request Forgery Bypass

LOW 20

The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00384 Published 2023-07-01 Fixed in 1.5.13 CWE-352

TI-2023-13778 CVE-2023-29388 · GHSA-xh49-j9w7-xf24

WordPress Product Catalog Simple Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-04-07 No fix listed CWE-79

Vulnerabilities

Filters

Product Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode

WordPress Product Catalog Simple Plugin <= 1.7.6 is vulnerable to Sensitive Data Exposure

Product Catalog Simple <= 1.5.13 - Cross-Site Request Forgery Bypass

WordPress Product Catalog Simple Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)