CVE-2026-32450
DOM-Based XSS in Active Products Tables for WooCommerce
Publication date: 2026-03-13
Last updated on: 2026-03-13
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| realmag777 | active_products_tables_for_woocommerce | to 1.0.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts on your website, potentially leading to unauthorized redirects, display of unwanted advertisements, or other harmful HTML payloads.
Since exploitation requires interaction by a privileged user, the risk is somewhat limited but still significant if such users are tricked into performing the required actions.
The vulnerability has a CVSS score of 6.5, indicating moderate severity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-32450 vulnerability, users should update the Active Products Tables for WooCommerce plugin to version 1.0.8 or later, where the issue has been patched.
Additionally, limiting privileged user interactions and avoiding clicking on suspicious links or submitting untrusted forms can reduce the risk of exploitation.
Patchstack also provides mitigation services including auto-updates for vulnerable plugins, which can help maintain security.
Can you explain this vulnerability to me?
CVE-2026-32450 is a Cross Site Scripting (XSS) vulnerability affecting the WordPress Active Products Tables for WooCommerce Plugin versions up to and including 1.0.7.
This vulnerability allows a malicious actor to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website, which execute when visitors access the site.
Exploitation requires user interaction by a privileged user with at least Contributor or Developer roles, who must perform an action like clicking a malicious link, visiting a crafted page, or submitting a form.
The issue is classified under OWASP Top 10 category A3: Injection.