CVE-2026-15441
Received Received - Intake

CSS Injection in WC Product Table Lite WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-15441
EUVD
EUVD-2026-59861

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_product_table_lite wc_product_table_lite to 5.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WC Product Table Lite WordPress plugin up to version 5.6.0 has a CSS injection flaw. An unauthenticated attacker can exploit the wcpt_ajax() handler, which processes user-supplied attributes via AJAX. The plugin decodes JSON input but only checks key names, not values, and strips limited characters before passing data to a shortcode function. This allows arbitrary CSS injection into inline styles on product tables with sticky sidebar enabled.

Detection Guidance

Check for the presence of the WC Product Table Lite plugin version 5.6.0 or lower. Inspect WordPress sites for unauthenticated AJAX calls to wp_ajax_nopriv_wcpt_ajax with the 'laptop_scroll_offset' parameter. Review server logs for suspicious inline CSS injections in product tables with sticky sidebar enabled.

Impact Analysis

An attacker could inject malicious CSS to steal data via background images, trick users with fake interfaces, or bypass security policies that allow inline styles. This could lead to phishing attacks, session hijacking, or unauthorized data access on affected WordPress sites using the vulnerable plugin.

Compliance Impact

This vulnerability could lead to data exfiltration or unauthorized access, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive data. Organizations may face compliance breaches if user data is compromised through this exploit.

Mitigation Strategies

Update the WC Product Table Lite plugin to the latest version. Disable the 'laptop_scroll_offset' shortcode attribute if possible. Implement strict input validation for AJAX parameters. Monitor for unauthorized CSS injections in product tables.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart