Medium severity6.4NVD Advisory· Published May 10, 2026· Updated May 28, 2026

CVE-2021-47924

Description

Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter. Attackers can submit POST requests to post.php with HTML/JavaScript payloads in the price field to execute arbitrary code when the product is viewed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Ultimate Product Cataloguereferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 5.8.2
Package: https://wordpress.org/plugins/ultimate-product-catalogue

Patches

Vulnerability mechanics

References

wordpress.org/plugins/ultimate-product-catalogue/nvd
www.etoilewebdesign.comnvd
www.exploit-db.com/exploits/50534nvd
www.vulncheck.com/advisories/wordpress-plugin-ultimate-product-catalog-stored-xss-via-pricenvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000