Ultimate Product Catalog Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Ultimate Product Catalog WordPress plugin, specifically in version 5.8.2. This vulnerability allows authenticated attackers to inject malicious scripts into the price parameter. Exploitation involves sending POST requests to post.php with HTML or JavaScript payloads in the price field, which are then executed when the product is viewed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the product.

Reproduction

To reproduce this vulnerability, an authenticated user can inject a script payload into the price field of a product. After saving the product, the injected script will execute when the product is viewed.