Ultimate Product Catalog < 3.1.3 - Multiple Vulnerabilities

The Ultimate Product Catalog plugin for WordPress has multiple vulnerabilities in versions up to, and including, 3.1.2. This is due to a lack of sanitization of user input and insufficient checks on file types. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link, and for authenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.