Active Products Tables For Woocommerce CVE-2026-32450

While the CVSS v3.1 score of 6.5 appears moderate, the actual risk is significantly lower when cross-referenced with exploitation signals: (1) EPSS score of 0.03% (8th percentile) indicates very low likelihood of active exploitation in the wild; (2) No KEV (Known Exploited Vulnerability) status is reported, suggesting no documented active attacks; (3) Attack vector is Network/Adjacent but requires Logged-in user (PR:L) and user interaction (UI:R), reducing attack surface; (4) Impact is limited to confidentiality, integrity, and availability at 'Low' severity each. SSVC analysis suggests this is NOT a priority for immediate patching in typical enterprise environments due to low automation potential and authentication requirement, though it warrants standard patch management cycles. This is a classic case of moderate CVSS with minimal real-world exploitation risk.

An authenticated WordPress user with low privileges (e.g., contributor or shop manager) crafts a malicious URL or form submission that injects JavaScript into a page displaying the Active Products Tables. When another user (including administrators) views the affected page, the injected script executes in their browser context, potentially stealing session tokens, modifying product data, or redirecting to phishing sites. Attack requires user interaction (clicking a link, visiting a crafted page) and authenticated access, limiting opportunistic exploitation. No public proof-of-concept is documented in available intelligence sources, further reducing exploitation likelihood.