The eCommerce Product Catalog plugin for WordPress has a security problem in versions up to 3.3.8. It is vulnerable to a type of attack called Stored Cross-Site Scripting. This type of attack can be done by someone who has administrator-level privileges and can inject malicious code into web pages. This code will then be executed whenever someone accesses the page. This only affects certain types of WordPress installations.