What is the CVSS score of EUVD-2026-59861?

EUVD-2026-59861 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.4%.

WC Product Table Lite EUVD-2026-59861

| CVE-2026-15441 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-16 Wordfence

GHSA-xrjc-4wc6-p53x

WordPress RCE Wordpress Plugin Product Table List Builder For Woocommerce Wcproducttable

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R because the reflected AJAX-based CSS injection requires a victim to load the affected page; C:L added to reflect the documented CSS attribute-selector exfiltration capability omitted from the provided vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 05:09 vuln.today

CVE Published

Aug 16, 2026 - 04:24 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles.

AnalysisAI

CSS injection in WC Product Table Lite (WordPress plugin, versions ≤ 5.6.0) allows unauthenticated remote attackers to embed arbitrary CSS into any page rendering a product table with sticky sidebar enabled. The flaw originates in the unauthenticated wp_ajax_nopriv_wcpt_ajax AJAX handler, which JSON-decodes attacker-supplied shortcode attributes, enforces only a key-name allowlist without sanitizing values, and interpolates the raw laptop_scroll_offset value directly into inline CSS without numeric casting or escaping. While the assigned CVSS score of 5.3 carries C:N, the real-world impact is broader: the injection vector supports CSS-based data exfiltration via attribute-selector background-image chaining, UI redressing, and phishing that bypasses CSPs permitting inline styles - risks not captured in the base score. No public exploit code or CISA KEV listing was identified at time of analysis.

Technical ContextAI

The affected product is identified by CPE cpe:2.3:a:wcproducttable:product_table_&_list_builder_for_woocommerce:*:*:*:*:*:*:*:*, covering WC Product Table Lite (marketed as Product Table & List Builder for WooCommerce) across all versions through 5.6.0. The root cause maps to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection). WordPress registers wcpt_ajax() on the wp_ajax_nopriv_wcpt_ajax hook, making it callable without authentication via wp-admin/admin-ajax.php. The handler JSON-decodes user-supplied shortcode attributes, enforces an allowlist only on key names, and runs a preg_replace that strips only [ ] < >, leaving CSS metacharacters such as semicolons, braces, colons, and parentheses intact. The unsanitized laptop_scroll_offset value is passed through WordPress's do_shortcode() into wcpt_style__sticky_sidebar(), where it is directly interpolated into top: {$top}px; and max-height: calc(100vh - {$top}px); with no numeric casting. Vulnerable code paths are confirmed at style-functions.php#L995, main.php#L2677, and main.php#L2686 in the WordPress plugin repository, with tagged releases 5.1.0 and 5.4.0 both verified as vulnerable via the cited source references.

RemediationAI

Upgrade WC Product Table Lite to a version beyond 5.6.0 once a confirmed patched release is published. An upstream fix commit exists in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3638932%40wc-product-table-lite&new=3638932%40wc-product-table-lite; however, the exact patched release version number is not independently confirmed from the available data and must be verified against the WordPress plugin directory before deploying. Until a patched version is confirmed, disable the sticky sidebar feature in WC Product Table Lite settings to remove the wcpt_style__sticky_sidebar() code path entirely; this eliminates the injection surface at the cost of the sticky sidebar UI behavior. As an additional compensating control, a WAF rule blocking requests to wp-admin/admin-ajax.php?action=wcpt_ajax containing CSS metacharacters (;, {, }, url() in shortcode attribute parameter values can reduce exposure while retaining general plugin functionality, with the trade-off of potential false positives on attribute values containing colons. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0a8be1-8853-4863-90e5-af3831f800e9 for patch version confirmation.