Active Products Tables CVE-2026-57409

Exploitation requires the target site to be running the Active Products Tables for WooCommerce plugin at version 1.1.0 or earlier on a WordPress/WooCommerce installation, and requires victim interaction (UI:R) - the victim must load or click an attacker-controlled page, link, or input that reaches the plugin's DOM-based rendering sink. No authentication is required (PR:N) and attack complexity is low (AC:L), so no special account or elevated privileges are needed, but the reliance on user interaction and on the specific vulnerable plugin being installed and rendering the malicious input are the key limiting factors that constrain real-world exploitation to socially-engineered or lured victims rather than automated mass compromise.

The supplied CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges, but requiring user interaction, with low confidentiality/integrity/availability impact amplified by a changed scope. This is a typical stored/reflected/DOM XSS risk profile - meaningful but dependent on luring a victim rather than fully automatable server compromise. No EPSS probability was provided, it is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent widespread exploitation; the practical priority is moderate and driven by how widely the plugin is deployed. The UI:R requirement is the main limiting factor and should temper the raw High score. No conflicting signals were observed in the data, but the absence of EPSS and any SSVC decision fields means automatability and real-world exploitation likelihood cannot be quantified from the input.

An attacker crafts a URL or storefront input containing a malicious script payload that the plugin's client-side table renderer writes into the page DOM without sanitization, then entices a shopper or store administrator to open it (UI:R). When the victim loads the page, the script executes in their browser session, allowing session token theft, defacement, or actions on the victim's behalf; with scope change, impact can reach beyond the plugin's context. No public POC is referenced, so an attacker would need to develop the payload independently.