Input validation vulnerability in ShopConstruct – Product Catalog, Shopping Cart and eCommerce solution for Store 1.1.2

The ShopConstruct plugin for WordPress is vulnerable to a type of attack called Reflected Cross-Site Scripting. In versions up to and including 1.1.2 of this plugin, attackers can inject arbitrary web scripts into pages if they can get a user to perform an action, such as clicking a link. This is possible because the plugin does not sanitize or escape the input of certain parameters like ‘page’ and ‘shop_ct_path’.