Wcproducttable
Monthly
CSS injection in WC Product Table Lite (WordPress plugin, versions ≤ 5.6.0) allows unauthenticated remote attackers to embed arbitrary CSS into any page rendering a product table with sticky sidebar enabled. The flaw originates in the unauthenticated `wp_ajax_nopriv_wcpt_ajax` AJAX handler, which JSON-decodes attacker-supplied shortcode attributes, enforces only a key-name allowlist without sanitizing values, and interpolates the raw `laptop_scroll_offset` value directly into inline CSS without numeric casting or escaping. While the assigned CVSS score of 5.3 carries C:N, the real-world impact is broader: the injection vector supports CSS-based data exfiltration via attribute-selector background-image chaining, UI redressing, and phishing that bypasses CSPs permitting inline styles - risks not captured in the base score. No public exploit code or CISA KEV listing was identified at time of analysis.
The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.9.4. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite allows Exploiting Incorrectly Configured Access Control Security Levels.8.7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Improper Control of Generation of Code ('Code Injection') vulnerability in WC Product Table WooCommerce Product Table Lite allows Code Injection.5.1. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Cross-Site Request Forgery (CSRF) vulnerability in WC Product Table WooCommerce Product Table Lite.6.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CSS injection in WC Product Table Lite (WordPress plugin, versions ≤ 5.6.0) allows unauthenticated remote attackers to embed arbitrary CSS into any page rendering a product table with sticky sidebar enabled. The flaw originates in the unauthenticated `wp_ajax_nopriv_wcpt_ajax` AJAX handler, which JSON-decodes attacker-supplied shortcode attributes, enforces only a key-name allowlist without sanitizing values, and interpolates the raw `laptop_scroll_offset` value directly into inline CSS without numeric casting or escaping. While the assigned CVSS score of 5.3 carries C:N, the real-world impact is broader: the injection vector supports CSS-based data exfiltration via attribute-selector background-image chaining, UI redressing, and phishing that bypasses CSPs permitting inline styles - risks not captured in the base score. No public exploit code or CISA KEV listing was identified at time of analysis.
The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.9.4. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite allows Exploiting Incorrectly Configured Access Control Security Levels.8.7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Improper Control of Generation of Code ('Code Injection') vulnerability in WC Product Table WooCommerce Product Table Lite allows Code Injection.5.1. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Cross-Site Request Forgery (CSRF) vulnerability in WC Product Table WooCommerce Product Table Lite.6.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.