WordPress plugin
Ultimate Product Catalog security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 13 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High4
- Medium6
- Low0
All Ultimate Product Catalog vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Contributor+) Arbitrary File Upload ≤4.4.48Update to 5.0.0 | CVE-2016-20075 | |
| Medium4.3 | Cross-Site Request Forgery via reset_settings() ≤5.2.15Update to 5.2.16 | CVE-2024-31921 | |
| Medium4.4 | Authenticated(Administrator+) Stored Cross-Site Scripting ≤5.2.5Update to 5.2.6 | CVE-2023-2711 | |
| Medium6.5 | Cross-Site Request Forgery <5.0.26Update to 5.0.26 | CVE-2021-24993 | |
| High8.8 | Authorization Bypass and Cross-Site Request Forgery ≤4.2.21Update to 4.2.22 | — | |
| Medium6.1 | Cross-Site Scripting ≤4.2.11Update to 4.2.12 | CVE-2017-12200 | |
| Critical9.8 | SQL Injection ≤4.2.22Update to 4.2.23 | CVE-2017-12199 | |
| Medium5.4 | Authenticated SQL Injection <4.2.3Update to 4.2.3 | — | |
| Medium4.3 | Missing Authorization to Plugin Settings Update <3.8.2Update to 3.8.2 | — | |
| Critical9.8 | SQL Injection <3.1.3Update to 3.1.3 | — | |
| High8.8 | Multiple Vulnerabilities <3.1.3Update to 3.1.3 | — | |
| Critical9.8 | Arbitrary File Upload <4.2.22Update to 4.2.22 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection ≤2.1Update to 2.1.1 | — |
- High8.8Authenticated (Contributor+) Arbitrary File Upload
≤4.4.48Update to 5.0.0
- Medium4.3Cross-Site Request Forgery via reset_settings()
≤5.2.15Update to 5.2.16
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
≤5.2.5Update to 5.2.6
- Medium6.5Cross-Site Request Forgery
<5.0.26Update to 5.0.26
- High8.8Authorization Bypass and Cross-Site Request Forgery
≤4.2.21Update to 4.2.22
- Medium6.1Cross-Site Scripting
≤4.2.11Update to 4.2.12
- Critical9.8SQL Injection
≤4.2.22Update to 4.2.23
- Medium5.4Authenticated SQL Injection
<4.2.3Update to 4.2.3
- Medium4.3Missing Authorization to Plugin Settings Update
<3.8.2Update to 3.8.2
- Critical9.8SQL Injection
<3.1.3Update to 3.1.3
- High8.8Multiple Vulnerabilities
<3.1.3Update to 3.1.3
- Critical9.8Arbitrary File Upload
<4.2.22Update to 4.2.22
- High7.2Authenticated (Admin+) SQL Injection
≤2.1Update to 2.1.1
Ultimate Product Catalog: common questions
Does Ultimate Product Catalog have known vulnerabilities?
Yes. VulnCrest Radar lists 13 known vulnerabilities in Ultimate Product Catalog: 3 critical, 4 high, 6 medium. None are known to affect version null.
How do I check which version of Ultimate Product Catalog I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Ultimate Product Catalog vulnerability?
CVE-2016-20075, published Jun 15, 2026: Ultimate Product Catalog <= 4.4.48 - Authenticated (Contributor+) Arbitrary File Upload. Severity: High (CVSS 8.8).
Is any Ultimate Product Catalog vulnerability listed in CISA KEV?
No. None of the known Ultimate Product Catalog vulnerabilities is currently listed in the CISA KEV catalog.