Medium severity6.4NVD Advisory· Published May 10, 2026· Updated May 12, 2026

CVE-2021-47924

Description

Ultimate Product Catalog 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter. Attackers can submit POST requests to post.php with HTML/JavaScript payloads in the price field to execute arbitrary code when the product is viewed.

Affected products

WordPress/Ultimate Product Cataloguereferences
Package: https://wordpress.org/plugins/ultimate-product-catalogue
Etoilewebdesign/Ultimate Product Catalogllm-fuzzy
Range: =5.8.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

wordpress.org/plugins/ultimate-product-catalogue/nvd
www.etoilewebdesign.comnvd
www.exploit-db.com/exploits/50534nvd
www.vulncheck.com/advisories/wordpress-plugin-ultimate-product-catalog-stored-xss-via-pricenvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000