SZB-6e7431383e
EUVD lists unauthenticated XSS in eCommerce Product Catalog 3.6.5 and earlier
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- impleCode
- Product
- eCommerce Product Catalog
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114308, as relayed in a Mastodon post, describes an unauthenticated cross-site scripting flaw in eCommerce Product Catalog versions up to 3.6.5. The entry gives a CVSS v3.1 score of 7.1 and was last updated 2026-10-30.
If you use impleCode
Update eCommerce Product Catalog to a version later than 3.6.5 if one is available
Review product pages and catalog entries for injected scripts
Deactivate the plugin if no fixed version is available
What the sources say 1
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.” Source