Arbitrary Content Injection Vulnerability in CatalogX WordPress Plugin
CVE-2026-79621
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-79621?
The CatalogX WordPress plugin prior to version 6.1.3 does not properly sanitize or escape user-supplied content, which allows unauthenticated users to inject arbitrary data into the product enquiry notification emails sent to site administrators. This vulnerability can lead to potential spoofing or delivery of malicious content when an unrelated visitor submits a product inquiry form, posing security risks for the site.
Affected Version(s)
CatalogX 0 < 6.1.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.