Wc Product Table Lite Vulnerabilities

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied at...

CVSS:

5.3

Affected:

up to 5.6.0

Fixed in:

5.6.5

Disclosed:

Aug 15, 2026

CVE-2026-15441 on NVD →

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVSS:

7.2

Affected:

up to 4.6.3

Fixed in:

4.6.4

Disclosed:

Apr 7, 2026

CVE-2026-34902 on NVD →

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...

CVSS:

7.5

Affected:

up to 4.6.2

Fixed in:

4.6.3

Disclosed:

Feb 18, 2026

CVE-2026-2232 on NVD →

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.9.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.9.5

Fixed in:

3.9.6

Disclosed:

Apr 16, 2025

CVE-2025-39602 on NVD →

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.9.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthen...

CVSS:

7.3

Affected:

up to 3.9.4

Fixed in:

3.9.5

Disclosed:

Jan 30, 2025

CVE-2024-13472 on NVD →

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.8.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.8.7

Fixed in:

3.9.0

Disclosed:

Jan 24, 2025

CVE-2025-24596 on NVD →

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthen...

CVSS:

7.3

Affected:

up to 3.8.6

Fixed in:

3.8.7

Disclosed:

Nov 19, 2024

CVE-2024-10899 on NVD →

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthen...

CVSS:

4.8

Affected:

up to 3.5.1

Fixed in:

3.8.6

Disclosed:

Aug 7, 2024

CVE-2024-43128 on NVD →

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access a...

CVSS:

6.4

Affected:

up to 3.5.1

Fixed in:

3.8.6

Disclosed:

Jul 26, 2024

CVE-2024-6458 on NVD →

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.2. This is due to missing nonce validation on the wcpt_settings_page() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged requ...

CVSS:

4.3

Affected:

up to 2.6.2

Fixed in:

3.1.0

Disclosed:

Nov 7, 2023

CVE-2023-47519 on NVD →

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘price_range_min’ and ‘price_range_max’ parameters in versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...

CVSS:

6.1

Affected:

up to 2.3.0

Fixed in:

2.4.0

Disclosed:

Sep 27, 2021