Reflected Cross-Site Scripting in WooCommerce Plugin Due to Insufficient Input Sanitization

CVE-2025-0864

What is CVE-2025-0864?

The Active Products Tables for WooCommerce plugin is susceptible to Reflected Cross-Site Scripting, enabling attackers to exploit the 'shortcodes_set' parameter. This vulnerability arises from inadequate input sanitization and output escaping practices. As a result, unauthorized attackers could potentially inject malicious scripts into web pages. If a user is deceived into clicking a crafted link, the injected scripts may execute within their browser context, compromising user information and site integrity.

References