← Back

Ultimate Product Catalog

ultimate_product_catalog

Vendor: Etoilewebdesign • 4 CVEs

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-2711
1Etoilewebdesign
1Ultimate Product Catalog
Nov 21, 2024
Jun 27, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when...Show more
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)Show less
CVE-2021-24993
1Etoilewebdesign
1Ultimate Product Catalog
Nov 21, 2024
Feb 7, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary p...Show more
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for exampleShow less
CVE-2017-12200
1Etoilewebdesign
1Ultimate Product Catalog
May 13, 2026
Aug 2, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.
CVE-2017-12199
1Etoilewebdesign
1Ultimate Product Catalog
May 13, 2026
Aug 2, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-...Show more
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.Show less