Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-15441— Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter

Quick assessment

Affected
wcproducttable Product Table & List Builder For WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress WC Product Table Lite是WordPress基金会开源的一款以表格形式展示商品的CMS插件。 WordPress WC Product Table Lite 5.6.0及之前版本存在输入验证错误漏洞，该漏洞源于'laptop_scroll_offset'短代码属性在wcpt_ajax() AJAX处理器中处理不当，未进行数值转换或CSS转义，导致CSS注入。未经验证的攻击者可利用该漏洞注入任意CSS声明和规则，可能造成数据渗出、界面伪装以及绕过允许内联样式的CSP的钓

CVSS 5.3 · Medium EPSS 0.53% · P43

Affected Version Matrix 1

VendorProduct Version RangeStatus
wcproducttable Product Table & List Builder For WooCommerce ≤ 5.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15441

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress WC Product Table Lite 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress WC Product Table Lite是WordPress基金会开源的一款以表格形式展示商品的CMS插件。 WordPress WC Product Table Lite 5.6.0及之前版本存在输入验证错误漏洞，该漏洞源于'laptop_scroll_offset'短代码属性在wcpt_ajax() AJAX处理器中处理不当，未进行数值转换或CSS转义，导致CSS注入。未经验证的攻击者可利用该漏洞注入任意CSS声明和规则，可能造成数据渗出、界面伪装以及绕过允许内联样式的CSP的钓
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
wcproducttable Product Table & List Builder For WooCommerce 0 ~ 5.6.0 -

II. Public POCs for CVE-2026-15441

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15441

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same vendor: wcproducttable
Same weakness: CWE-74

V. Comments for CVE-2026-15441

No comments yet

Leave a comment