eCommerce Product Catalog: Reflected Cross-Site Scripting (CVE-2026-115596)

CVE-2026-115596 is an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability affecting the 'eCommerce Product Catalog' WordPress plugin. The flaw exists because the ic-search-keyword parameter is not properly sanitized when submitted via a POST request body. Successful exploitation enables an attacker to execute malicious JavaScript in the context of a victim's session, potentially leading to unauthorized actions or session hijacking.

Attack Chain

1. Attacker hosts a malicious webpage containing an auto-submitting POST form.
2. The form is configured to target the /?post_type=al_product endpoint on a WordPress site running the vulnerable plugin.
3. The form includes the ic-search-keyword parameter populated with malicious JavaScript.
4. The attacker lures an authenticated user to the malicious webpage.
5. The victim's browser automatically submits the POST request to the WordPress site.
6. The plugin reflects the malicious payload unescaped in the resulting page response.
7. The victim's browser executes the injected JavaScript within the site's origin.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the user's browser, potentially resulting in session hijacking, unauthorized actions performed on behalf of the victim, or the theft of sensitive session data.

Recommendation

• Identify all WordPress instances utilizing the 'eCommerce Product Catalog' plugin and confirm the current version.
• Patch the plugin immediately upon the release of a security update addressing CVE-2026-115596.
• Implement a Web Application Firewall (WAF) to inspect POST bodies for suspicious script injection patterns targeting the ic-search-keyword parameter.
• Review WordPress access logs for anomalous POST requests to the /?post_type=al_product endpoint, particularly those originating from external referrers.