CVE-2026-79621
CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
| Vendor | unknown |
| Product | catalogx |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown catalogx
Be the first to know when new medium vulnerabilities affecting unknown catalogx are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / CatalogX
0 < 6.1.3
References
Credits
Shikhali Jamalzade WPScan