What is the CVSS score of CVE-2026-57409?

CVE-2026-57409 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-57409?

Within 24 hours, audit all WooCommerce installations to identify deployments of the 'Active Products Tables for WooCommerce' plugin (slug: profit-products-tables-for-woocommerce, versions ≤1.1.0) and document risk tier by exposure level. Within 7 days, either deactivate and remove the plugin entirely if non-critical, or implement Web Application Firewall rules to block DOM-based XSS payloads targeting the vulnerable component. Within 30 days, monitor the plugin vendor's WordPress.org plugin page and GitHub repository for a security patch (v1.1.1 or later); deploy immediately upon release and verify through penetration testing.

Active Products Tables CVE-2026-57409

EUVD-2026-43481 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Active Products Tables For Woocommerce Wordpress Plugin Realmag777

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable DOM XSS needs no privileges but requires victim interaction (UI:R), executes in another security context (S:C), with limited C/I/A impact typical of client-side script injection.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:57 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.1.0.

Articles & Coverage 1

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026

AnalysisAI

DOM-based cross-site scripting affects the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (slug profit-products-tables-for-woocommerce) in all versions through 1.1.0, letting a remote attacker deliver crafted input that is unsafely written into the DOM and executed as script in a victim's browser. Because the CVSS scope is changed (S:C) and no authentication is required (PR:N), successful exploitation can affect resources beyond the vulnerable component, though it requires the victim to interact with an attacker-influenced page or link (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.

Technical ContextAI

The affected component is a WooCommerce add-on for WordPress that renders interactive product tables on storefront pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-based variant, meaning untrusted data reaches a client-side sink (such as innerHTML, document.write, or a JavaScript-driven table renderer) without proper output encoding or sanitization, so the payload never needs to touch the server to execute. The affected package is identified by CPE cpe:2.3:a:realmag777:active_products_tables_for_woocommerce:*:*:*:*:*:*:*:*, covering all releases up to and including 1.1.0. DOM-based XSS is particularly relevant here because the plugin's product-table rendering is JavaScript-heavy, and such flaws often bypass server-side WAF filtering since the malicious data may live in the URL fragment or client-processed parameters.

RemediationAI

No fixed version is stated in the provided data, so no vendor-released patch is identified at time of analysis; monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for a release above 1.1.0 and upgrade as soon as it ships. Until a patched version is available, consider deactivating and removing the Active Products Tables for WooCommerce plugin if the product-table feature is non-essential - the trade-off is loss of that storefront functionality. As compensating controls, deploy a WordPress-aware WAF or Patchstack virtual patch to filter XSS payloads targeting the plugin's parameters, and add a restrictive Content-Security-Policy that disallows inline script execution to blunt DOM-based payloads, accepting that a strict CSP may break other themes or plugins that rely on inline JavaScript and will require testing before enforcement.