CVE-2026-76128

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags; the tainted HTML output is only generated at render time by the shortcode handler.

• CWE-79

• https://plugins.trac.wordpress.org/browser/ecommerce-product-catalog/tags/3.5.9/ic/simple-formbuilder/pluggable.php#L840
• https://plugins.trac.wordpress.org/browser/ecommerce-product-catalog/tags/3.5.9/ic/simple-formbuilder/pluggable.php#L842
• https://plugins.trac.wordpress.org/changeset/3656358/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bb2778ee-f875-4494-ad42-fccc7b38d692?source=cve

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7609A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. …8.8
• CVE-2026-76098Mistune is a Python Markdown parser with renderers and plugi…7.5
• CVE-2026-7610A vulnerability has been found in TRENDnet TEW-821DAP 1.12B0…8.1
• CVE-2026-7611A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B…8.1
• CVE-2026-76111Dell PowerStore contains an Incorrect Authorization vulnerab…8.8
• CVE-2026-7612A vulnerability was determined in itsourcecode Courier Manag…4.7
• CVE-2026-7613The Cost of Goods by PixelYourSite plugin for WordPress is v…7.2
• CVE-2026-76131Use of hard-coded credentials issue exists in VOCALOID6 , wh…5.3
• CVE-2026-76133The affected Ebyte product uses a deprecated hashing algo…9.8
• CVE-2026-76137Missing authentication for critical function vulnerability e…3.3
• CVE-2026-76139A flaw was found in acm-operator-bundle. The build process f…8
• CVE-2026-7614The Old Posts Highlighter plugin for WordPress is vulnerable…4.3