Plugin security history

eCommerce Product Catalog Plugin for WordPress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 18 vulnerability records associated with eCommerce Product Catalog Plugin for WordPress, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

18Total records

0Critical

3High

15Medium

0Low

0Informational

18Patched records

0Currently marked unpatched

2021-03-01First disclosure

2026-07-01Latest disclosure

14 of 18CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	3	3 records
2022	4	4 records
2023	5	5 records
2024	3	3 records
2025	1	1 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
High	3	16.7%
Medium	15	83.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

10 records55.6%

First: 2021. Latest: 2026.

CSRF

5 records27.8%

First: 2021. Latest: 2024.

Information Disclosure

1 record5.6%

First: 2023. Latest: 2023.

Other

1 record5.6%

First: 2025. Latest: 2025.

SQL Injection

1 record5.6%

First: 2026. Latest: 2026.

Patch Status

Patched: 18
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.5.5
3.5.6
3.4.4
3.3.44
3.3.33
3.3.29
3.3.27
3.3.26
3.3.9
3.3.5
3.0.72
3.0.70
3.0.71
3.0.39
2.9.44
3.0.18

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.5.4`	eCommerce Product Catalog Plugin for WordPress <= 3.5.4 - Unauthenticated Stored Cross-Site Scripting	July 1, 2026	3.5.5	High
`*-3.5.5`	eCommerce Product Catalog Plugin for WordPress <= 3.5.5 - Unauthenticated SQL Injection	June 9, 2026	3.5.6	High
`*-3.4.3`	eCommerce Product Catalog <= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection	June 22, 2025	3.4.4	Medium
`*-3.3.43`	eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset	December 20, 2024	3.3.44	High
`*-3.3.32`	eCommerce Product Catalog Plugin for WordPress <= 3.3.32 - Reflected Cross-Site Scripting	April 18, 2024	3.3.33	Medium
`*-3.3.28`	eCommerce Product Catalog <= 3.3.28 - Cross-Site Request Forgery	April 12, 2024	3.3.29	Medium
`[*, 3.3.27)`	eCommerce Product Catalog <= 3.3.26 - Sensitive Information Exposure via CSV Files	December 27, 2023	3.3.27	Medium
`*-3.3.26`	eCommerce Product Catalog for WordPress <= 3.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	November 14, 2023	3.3.27	Medium
`[*, 3.3.26)`	eCommerce Product Catalog for WordPress <= 3.3.25 - Cross-Site Request Forgery	November 13, 2023	3.3.26	Medium
`*-3.3.8`	eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting	March 17, 2023	3.3.9	Medium
`*-3.3.4`	Vulnerability: eCommerce Product Catalog plugin for WordPress <= 3.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting	February 6, 2023	3.3.5	Medium
`*-3.0.71`	eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting	October 17, 2022	3.0.72	Medium
`*-3.0.71`	eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting	October 17, 2022	3.0.72	Medium
`*-3.0.69`	eCommerce Product Catalog Plugin for WordPress <= 3.0.69 - Reflected Cross-Site Scripting	October 11, 2022	3.0.70	Medium
`*-3.0.70`	eCommerce Product Catalog Plugin for WordPress <= 3.0.70 - Reflected Cross-Site Scripting	October 10, 2022	3.0.71	Medium
`[*, 3.0.39)`	eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting	October 25, 2021	3.0.39	Medium
`[*, 2.9.44)`	eCommerce Product Catalog Plugin for WordPress <= 2.9.43 - Cross-Site Request Forgery Bypass	March 21, 2021	2.9.44	Medium
`[*, 3.0.18)`	eCommerce Product Catalog Plugin for WordPress <= 3.0.17 - Cross-Site Request Forgery Bypass	March 1, 2021	3.0.18	Medium

Selected source records

Latest Records

HighCVE-2026-57360

eCommerce Product Catalog Plugin for WordPress <= 3.5.4 - Unauthenticated Stored Cross-Site Scripting

Published: July 1, 2026

Affected versions: *-3.5.4
Patched versions: 3.5.5

Original Wordfence record

HighCVE-2026-52693

eCommerce Product Catalog Plugin for WordPress <= 3.5.5 - Unauthenticated SQL Injection

Published: June 9, 2026

Affected versions: *-3.5.5
Patched versions: 3.5.6

Original Wordfence record

MediumCVE-2025-49331

eCommerce Product Catalog <= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection

Published: June 22, 2025

Affected versions: *-3.4.3
Patched versions: 3.4.4

Original Wordfence record

HighCVE-2024-12771

eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset

Published: December 20, 2024

Affected versions: *-3.3.43
Patched versions: 3.3.44

Original Wordfence record

MediumCVE-2024-32558

eCommerce Product Catalog Plugin for WordPress <= 3.3.32 - Reflected Cross-Site Scripting

Published: April 18, 2024

Affected versions: *-3.3.32
Patched versions: 3.3.33

Original Wordfence record

MediumCVE-2024-32437

eCommerce Product Catalog <= 3.3.28 - Cross-Site Request Forgery

Published: April 12, 2024

Affected versions: *-3.3.28
Patched versions: 3.3.29

Original Wordfence record

MediumCVE-2023-51688

eCommerce Product Catalog <= 3.3.26 - Sensitive Information Exposure via CSV Files

Published: December 27, 2023

Affected versions: [*, 3.3.27)
Patched versions: 3.3.27

Original Wordfence record

MediumCVE-2023-47839

eCommerce Product Catalog for WordPress <= 3.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: November 14, 2023

Affected versions: *-3.3.26
Patched versions: 3.3.27

Original Wordfence record

Highest-Severity Records

HighCVE-2024-12771

eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset

Published: December 20, 2024

Affected versions: *-3.3.43
Patched versions: 3.3.44

Original Wordfence record

HighCVE-2026-52693

eCommerce Product Catalog Plugin for WordPress <= 3.5.5 - Unauthenticated SQL Injection

Published: June 9, 2026

Affected versions: *-3.5.5
Patched versions: 3.5.6

Original Wordfence record

HighCVE-2026-57360

eCommerce Product Catalog Plugin for WordPress <= 3.5.4 - Unauthenticated Stored Cross-Site Scripting

Published: July 1, 2026

Affected versions: *-3.5.4
Patched versions: 3.5.5

Original Wordfence record

MediumCVE-2025-49331

eCommerce Product Catalog <= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection

Published: June 22, 2025

Affected versions: *-3.4.3
Patched versions: 3.4.4

Original Wordfence record

MediumCVE-2023-47839

eCommerce Product Catalog for WordPress <= 3.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: November 14, 2023

Affected versions: *-3.3.26
Patched versions: 3.3.27

Original Wordfence record

Medium

eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting

Published: October 17, 2022

Affected versions: *-3.0.71
Patched versions: 3.0.72

Original Wordfence record

MediumCVE-2021-24875

eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting

Published: October 25, 2021

Affected versions: [*, 3.0.39)
Patched versions: 3.0.39

Original Wordfence record

Medium

eCommerce Product Catalog Plugin for WordPress <= 3.0.70 - Reflected Cross-Site Scripting

Published: October 10, 2022

Affected versions: *-3.0.70
Patched versions: 3.0.71

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory