Description

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T06:17:18.390Z",
  "pubdate": "2026-09-02T06:17:18.390Z",
  "executiveSummary": "The CatalogX WordPress plugin prior to version 6.1.3 is susceptible to a Stored Email Injection vulnerability. This flaw arises from the improper sanitization and escaping of user-supplied data that is stored and subsequently rendered within product enquiry notification emails sent to site administrators.\nAn unauthenticated attacker can leverage this vulnerability to inject arbitrary content, such as malicious scripts or deceptive text, into the automated notification workflow. Because the payload is triggered when an unrelated visitor submits a legitimate enquiry, the attack vector is persistent and relies on the subsequent interaction of the system administrator.\nThe impact includes the potential for social engineering, phishing, or the compromise of administrative sessions if the injected content is rendered in a manner that leads to cross-site scripting (XSS) within the administrator's mail client or web interface. The vulnerability requires no authentication to exploit, making it accessible to any remote attacker capable of submitting a request to the plugin's enquiry system.",
  "technicalDetails": "The root cause of this vulnerability is the failure to implement rigorous input validation and output encoding on user-controlled fields processed by the CatalogX plugin before they are included in the backend notification email body. The plugin architecture assumes that content submitted via the product enquiry form is benign, failing to sanitize the input against common injection vectors.\nThe exploitation flow proceeds as follows: First, an unauthenticated attacker submits a specially crafted product enquiry through the publicly accessible enquiry form. During this submission, the attacker inputs malicious payloads into fields that the plugin subsequently stores in the database or caches for later inclusion in an email. The plugin fails to validate these inputs, allowing the injection of arbitrary characters, including HTML or script tags.\nSecond, the plugin retrieves this unsanitized data and dynamically embeds it into the message body of an email notification intended for the site administrator. This email is triggered automatically when a subsequent, legitimate user or the original attacker performs an enquiry action. The application performs no output encoding at the time of email generation, ensuring that the injected payload is preserved in the final notification.\nWhen the site administrator opens the notification email, the malicious content is rendered by the mail client. If the attacker has injected HTML or JavaScript, they may achieve secondary impact, such as defacement of the notification, delivery of phishing lures, or, depending on the mail client's security policy, the execution of scripts that could exfiltrate data or perform unauthorized actions in the administrator's context if the administrator clicks on malicious links or assets.\nAffected versions include all iterations of CatalogX prior to 6.1.3. The vulnerability is network-exposed, as the enquiry form is typically public-facing. Exploitation does not require elevated privileges, as the entry point is the unauthenticated submission process. Post-exploitation impact is primarily limited to the context of the administrator viewing the crafted emails, though the potential for social engineering and administrative session manipulation represents a significant security risk."
}