CVE-2023-2711

The Ultimate Product Catalog plugin for WordPress contains a stored cross-site scripting vulnerability in versions 5.2.5 and earlier that stems from inadequate sanitization of admin settings and insufficient escaping of output. An authenticated administrator or higher-privileged user can inject malicious scripts through the plugin's settings, which will then execute when other users view the affected pages. This vulnerability only impacts WordPress multisite installations and those where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).