Product Table List Builder For Woocommerce
Monthly
CSS injection in WC Product Table Lite (WordPress plugin, versions ≤ 5.6.0) allows unauthenticated remote attackers to embed arbitrary CSS into any page rendering a product table with sticky sidebar enabled. The flaw originates in the unauthenticated `wp_ajax_nopriv_wcpt_ajax` AJAX handler, which JSON-decodes attacker-supplied shortcode attributes, enforces only a key-name allowlist without sanitizing values, and interpolates the raw `laptop_scroll_offset` value directly into inline CSS without numeric casting or escaping. While the assigned CVSS score of 5.3 carries C:N, the real-world impact is broader: the injection vector supports CSS-based data exfiltration via attribute-selector background-image chaining, UI redressing, and phishing that bypasses CSPs permitting inline styles - risks not captured in the base score. No public exploit code or CISA KEV listing was identified at time of analysis.
CSS injection in WC Product Table Lite (WordPress plugin, versions ≤ 5.6.0) allows unauthenticated remote attackers to embed arbitrary CSS into any page rendering a product table with sticky sidebar enabled. The flaw originates in the unauthenticated `wp_ajax_nopriv_wcpt_ajax` AJAX handler, which JSON-decodes attacker-supplied shortcode attributes, enforces only a key-name allowlist without sanitizing values, and interpolates the raw `laptop_scroll_offset` value directly into inline CSS without numeric casting or escaping. While the assigned CVSS score of 5.3 carries C:N, the real-world impact is broader: the injection vector supports CSS-based data exfiltration via attribute-selector background-image chaining, UI redressing, and phishing that bypasses CSPs permitting inline styles - risks not captured in the base score. No public exploit code or CISA KEV listing was identified at time of analysis.