Input validation vulnerability in Ultimate Product Catalog 5.2.5

The Ultimate Product Catalog plugin for WordPress is vulnerable to a type of security threat called Stored Cross-Site Scripting. This type of threat is present in versions 5.2.5 and earlier of the plugin. It could let attackers with administrator-level permissions or higher inject malicious web scripts into pages on the website. These scripts could be executed whenever users access the affected pages. This type of vulnerability only affects WordPress websites that have multi-site installations or have disabled a security setting called ‘unfiltered_html’.