{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ecommerce-product-catalog/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:implecode:ecommerce_product_catalog:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-115596"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["eCommerce Product Catalog"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eCVE-2026-115596 is an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability affecting the 'eCommerce Product Catalog' WordPress plugin. The flaw exists because the \u003ccode\u003eic-search-keyword\u003c/code\u003e parameter is not properly sanitized when submitted via a POST request body. Successful exploitation enables an attacker to execute malicious JavaScript in the context of a victim's session, potentially leading to unauthorized actions or session hijacking.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker hosts a malicious webpage containing an auto-submitting POST form.\u003c/li\u003e\n\u003cli\u003eThe form is configured to target the \u003ccode\u003e/?post_type=al_product\u003c/code\u003e endpoint on a WordPress site running the vulnerable plugin.\u003c/li\u003e\n\u003cli\u003eThe form includes the \u003ccode\u003eic-search-keyword\u003c/code\u003e parameter populated with malicious JavaScript.\u003c/li\u003e\n\u003cli\u003eThe attacker lures an authenticated user to the malicious webpage.\u003c/li\u003e\n\u003cli\u003eThe victim's browser automatically submits the POST request to the WordPress site.\u003c/li\u003e\n\u003cli\u003eThe plugin reflects the malicious payload unescaped in the resulting page response.\u003c/li\u003e\n\u003cli\u003eThe victim's browser executes the injected JavaScript within the site's origin.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the user's browser, potentially resulting in session hijacking, unauthorized actions performed on behalf of the victim, or the theft of sensitive session data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all WordPress instances utilizing the 'eCommerce Product Catalog' plugin and confirm the current version.\u003c/li\u003e\n\u003cli\u003ePatch the plugin immediately upon the release of a security update addressing CVE-2026-115596.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to inspect POST bodies for suspicious script injection patterns targeting the \u003ccode\u003eic-search-keyword\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eReview WordPress access logs for anomalous POST requests to the \u003ccode\u003e/?post_type=al_product\u003c/code\u003e endpoint, particularly those originating from external referrers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T14:09:08Z","date_published":"2026-11-07T14:09:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-115596-xss/","summary":"An unauthenticated reflected XSS vulnerability in the eCommerce Product Catalog WordPress plugin allows attackers to execute arbitrary JavaScript by manipulating the ic-search-keyword POST parameter.","title":"eCommerce Product Catalog: Reflected Cross-Site Scripting (CVE-2026-115596)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-115596-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - ECommerce Product Catalog","version":"https://jsonfeed.org/version/1.1"}