Stored XSS Vulnerability in Product Catalog Simple by impleCode
CVE-2025-58992

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Product Catalog Simple
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58992?

The Product Catalog Simple plugin by impleCode contains a vulnerability that allows for stored cross-site scripting (XSS). By failing to properly neutralize input during web page generation, an attacker could inject malicious scripts. This could lead to unauthorized access to sensitive user data or perform actions on behalf of users without their consent. Users utilizing versions from n/a up to 1.8.2 should take immediate action to secure their implementations.

Affected Version(s)

Product Catalog Simple <= 1.8.2

References

https://patchstack.com/database/wordpress/plugin/post-typ...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ (Patchstack Alliance)
.
CVE-2025-58992 : Stored XSS Vulnerability in Product Catalog Simple by impleCode