Stored cross-site scripting in Active Woot Products Tables for WooCommerce
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is affected in all versions up to and including 2.1.5. Improper neutralization of input during web page generation (CWE-79) lets the 'help_title' parameter store scripts that run when a user opens an affected page. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages, and they execute whenever a user accesses an injected page.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'help_title' parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| realmag777 | Active Woot Products Tables for WooCommerce. 100% FREE | up to 2.1.5 | — | No fix listed | CNA |
- Active Woot Products Tables for WooCommerce. 100% FREE Vendorrealmag777 Affected up to 2.1.5 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Active Woot Products Tables for WooCommerce. 100% FREE.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-120579
- 2026-11-07 Alias added: GHSA-x38p-ggxc-9779
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d19d9234-2f74-41a9-8f7e-98da9e844e7c?source=cve
- https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L2268
- https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L2249
- https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/lib/helper.php#L38
- https://plugins.svn.wordpress.org/profit-products-tables-for-woocommerce/trunk/index.php
- https://plugins.trac.wordpress.org/changeset/3784667/profit-products-tables-for-woocommerce/trunk/index.php
More realmag777 vulnerabilities
- TI-2025-01427 HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion CVSS 3.1CRITICAL 9.8
- TI-2022-03728 InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE CVSS 3.1CRITICAL 9.8
- TI-2024-33882 WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-05993 HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2022-04104 WOOF - Products Filter for WooCommerce < 1.3.2 - Admin+ PHP Object Injection CVSS 3.1HIGH 7.2
- TI-2023-13184 Cross-site scripting in InPost Gallery WordPress Plugin CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-120579 · CVE Program
- CVE-2026-120579 · NVD
- GHSA-x38p-ggxc-9779 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences