CVE-2026-79621 — MEDIUM (4.3)

Vulnerability Description

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-345

References

https://wpscan.com/vulnerability/9a4c12ff-80d8-400c-abfa-de557ead3b07/

FAQ

What is CVE-2026-79621?

CVE-2026-79621 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site ad...

How severe is CVE-2026-79621?

CVE-2026-79621 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-79621?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.