Arbitrary Shortcode Execution Vulnerability in WooCommerce Product Table Lite by WordPress

CVE-2024-13472

Summary

The WooCommerce Product Table Lite plugin for WordPress is susceptible to arbitrary shortcode execution due to insufficient validation in handling user inputs. This vulnerability affects all plugin versions up to and including 3.9.4. An unauthenticated attacker can exploit the flaw by executing arbitrary shortcodes through the unvalidated 'sc_attrs' parameter. Additionally, this parameter is also prone to reflected cross-site scripting, which can further compromise the security of the affected site. It is critical for users of this plugin to implement necessary security measures to mitigate potential attacks.

References