Skip to content
PluginCanary

eCommerce Product Catalog

by impleCode · 7,000+ active installs · Checked 3 Nov 2026
Healthy5 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 3.6.6.

81/ 100 Canary Score
Sub-scores for eCommerce Product Catalog
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 3.6.6. Update to version 3.6.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 26 Oct 2026, fixed in 3.6.5. Update to version 3.6.5 or later.26 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 5 Oct 2026, fixed in 3.6.3. Update to version 3.6.3 or later.5 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Sep 2026, fixed in 3.6.1. Update to version 3.6.1 or later.28 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 24 Aug 2026, fixed in 3.5.11. Update to version 3.5.11 or later.24 Aug 2026Evidence
  • InfoSEC-39 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
impleCode27 Jan 2014 to 2 Nov 2026, 1137 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
40
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for eCommerce Product Catalog
Q1 20245
Q2 20244
Q3 20244
Q4 20244
Q1 20253
Q2 20253
Q3 20255
Q4 20252
Q1 20261
Q2 20268
Q3 20268
Q4 20266

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

0% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026eCommerce Product Catalog <= 3.6.5 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.6.53.6.60
26 Oct 2026eCommerce Product Catalog <= 3.6.4 - Reflected Cross-Site Scripting6.1<= 3.6.43.6.50
5 Oct 2026eCommerce Product Catalog <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.6.23.6.30
28 Sep 2026eCommerce Product Catalog <= 3.6.0 - Authenticated (Custom Role+) PHP Object Injection7.5<= 3.6.03.6.10
24 Aug 2026eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute6.4<= 3.5.103.5.110
1 Jul 2026eCommerce Product Catalog Plugin for WordPress <= 3.5.4 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.5.43.5.50
9 Jun 2026eCommerce Product Catalog Plugin for WordPress <= 3.5.5 - Unauthenticated SQL Injection7.5<= 3.5.53.5.60
22 Jun 2025eCommerce Product Catalog <= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection6.6<= 3.4.33.4.40
20 Dec 2024eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset8.8<= 3.3.433.3.440
18 Apr 2024eCommerce Product Catalog Plugin for WordPress <= 3.3.32 - Reflected Cross-Site Scripting6.1<= 3.3.323.3.330
12 Apr 2024eCommerce Product Catalog <= 3.3.28 - Cross-Site Request Forgery4.3<= 3.3.283.3.290
27 Dec 2023eCommerce Product Catalog <= 3.3.26 - Sensitive Information Exposure via CSV Files5.3< 3.3.273.3.270
14 Nov 2023eCommerce Product Catalog for WordPress <= 3.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 3.3.263.3.270
13 Nov 2023eCommerce Product Catalog for WordPress <= 3.3.25 - Cross-Site Request Forgery5.4< 3.3.263.3.260
17 Mar 2023eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 3.3.83.3.90
6 Feb 2023Vulnerability: eCommerce Product Catalog plugin for WordPress <= 3.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 3.3.43.3.50
17 Oct 2022eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting6.1<= 3.0.713.0.720
17 Oct 2022eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting6.1<= 3.0.713.0.720
11 Oct 2022eCommerce Product Catalog Plugin for WordPress <= 3.0.69 - Reflected Cross-Site Scripting6.1<= 3.0.693.0.700
10 Oct 2022eCommerce Product Catalog Plugin for WordPress <= 3.0.70 - Reflected Cross-Site Scripting6.1<= 3.0.703.0.711
25 Oct 2021eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting6.1< 3.0.393.0.390
21 Mar 2021eCommerce Product Catalog Plugin for WordPress <= 2.9.43 - Cross-Site Request Forgery Bypass4.3< 2.9.442.9.440
1 Mar 2021eCommerce Product Catalog Plugin for WordPress <= 3.0.17 - Cross-Site Request Forgery Bypass4.3< 3.0.183.0.180

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.7 from 270 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star224
4 star34
3 star5
2 star2
1 star5

Momentum

7,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for eCommerce Product Catalog
4 May 2026382
11 May 20263,640
18 May 20263,963
25 May 20266,700
1 Jun 2026741
8 Jun 2026877
15 Jun 2026790
22 Jun 2026446
29 Jun 2026319
6 Jul 2026520
13 Jul 2026504
20 Jul 2026315
27 Jul 2026315
3 Aug 2026325
10 Aug 20263,801
17 Aug 20268,498
24 Aug 20264,057
31 Aug 2026749
7 Sep 2026646
14 Sep 20263,850
21 Sep 20264,086
28 Sep 20266,640
5 Oct 20261,746
12 Oct 20263,996
19 Oct 20264,010
26 Oct 20267,385
2 Nov 2026965

Weekly downloads over the last 4 weeks are 57% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Commerce7 for WordPressScore 91 · 1,000+External Store for ShopifyScore 87 · 2,000+Product Catalog SimpleScore 86 · 1,000+WooCommerceScore 85 · 7,000,000+Easy Digital Downloads - eCommerce Payments and Subscriptions made easyScore 85 · 40,000+

Facts

Version3.6.8
AuthorimpleCode
Added27 Jan 2014
Last updated2 Nov 2026
Active installs7,000+
Requires WordPress5.9
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagsquote, catalog, ecommerce, shopping cart, request a quote

Other plugins by this author: Product Catalog Simple, Reviews Plus, Price Field, Mailer Dragon - Email Marketing Plugin for WordPress, Attributes Table, Shipping Options

Questions

Is eCommerce Product Catalog still maintained?

eCommerce Product Catalog was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is eCommerce Product Catalog safe?

eCommerce Product Catalog has no open unpatched vulnerabilities on record. 9 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns eCommerce Product Catalog?

The wordpress.org author is impleCode. Recent committers: impleCode, ndre, plugin-master. We have recorded no ownership change.

What can I use instead of eCommerce Product Catalog?

Plugins in the same category with a higher Canary Score: Commerce7 for WordPress, External Store for Shopify, Product Catalog Simple, WooCommerce, Easy Digital Downloads - eCommerce Payments and Subscriptions made easy.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue