Unauthenticated XSS in WooCommerce Product Table Lite

Executive Summary

This is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the WooCommerce Product Table Lite plugin for WordPress versions 5.6.7 and below. It allows attackers to inject malicious scripts into websites without authentication, potentially stealing visitor data or hijacking accounts.

Useful 0 Not Useful 0

Detection Guidance

Detecting this XSS vulnerability requires checking the installed version of WooCommerce Product Table Lite. Use WordPress admin panel to view plugin versions or run SQL query: SELECT * FROM wp_options WHERE option_name LIKE '%woocommerce_product_table_lite%'; in your database. Alternatively, use WP-CLI: wp plugin list --name=woocommerce-product-table-lite.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to steal visitor data, hijack user accounts, or perform actions on behalf of users. Successful exploitation requires a user to click a malicious link or submit a form, but the impact includes data theft and account compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR and HIPAA compliance requirements. Data breaches resulting from XSS attacks can expose sensitive information, leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update WooCommerce Product Table Lite to version 5.6.9 or higher. If immediate update is not possible, apply Patchstack's mitigation rule to block attacks until the update is applied. Remove or disable the plugin if not essential.

Useful 0 Not Useful 0