WooCommerce Product Table Lite EUVD-2026-89867

Exploitation requires a WordPress site running the WooCommerce Product Table Lite plugin at version 5.6.7 or earlier, with WooCommerce present. No authentication is required (PR:N), but the attack is gated by mandatory victim interaction (UI:R): the attacker must lure a user into clicking or loading a crafted request/URL that reflects the malicious payload, consistent with reflected XSS. The impact is confined to script execution in the victim's browser within the site's origin (session theft, actions as the victim); it does not by itself grant server access. Realistic risk is limited by the need for social engineering to deliver the link and by the plugin needing to be installed and active on the target store.

This is an unauthenticated Cross-Site Scripting flaw (CWE-79) in the WooCommerce Product Table Lite WordPress plugin (versions <= 5.6.7), reported by Patchstack and scored CVSS 3.1 7.1 (High). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation with no privileges required, but it critically depends on user interaction (UI:R) - a victim must be lured into triggering the malicious payload, which is characteristic of reflected rather than stored XSS. The scope change (S:C) reflects XSS executing in the browser's origin context, and the Low C/I/A impacts are typical of session-context script execution. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or automatable mass-exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' Realistically this is a moderate-priority issue: the unauthenticated attack surface and popularity of WooCommerce raise concern, but the mandatory user-interaction requirement and script-context-only impact keep it well below the tier of wormable or server-RCE bugs. Treat as a patch-in-normal-cycle item, prioritized somewhat higher on high-traffic e-commerce sites where luring victims is easier.

An attacker crafts a URL or web request to a WooCommerce store running Product Table Lite <= 5.6.7 that reflects an unsanitized parameter into a page, embedding JavaScript, then distributes that link via phishing, ads, or a malicious page. When a shopper or logged-in administrator clicks it, the script executes in their browser session and can steal cookies, hijack the session, or perform actions in the site's origin. No public exploit code was identified at the time of analysis, and successful exploitation requires the victim to interact with the attacker-supplied link (UI:R).