Ultimate Product Catalog < 5.2.6 - Admin+ Stored XSS

Proof of Concept

1. Navigate to the plugin setup page.
2. Go to the "Categories" section.
3. In the "Category Name" field, input the payload: `<noscript><p title="</noscript><img src=x onerror=alert(1)>`
4. Go to the fourth page and select "Create a Product".
5. In every field except "Product Image", input the payload: `<noscript><p title="</noscript><img src=x onerror=alert(1)>`
6. The payload will be executed, demonstrating the vulnerability.