CSS Injection Vulnerability in WC Product Table Lite Plugin for WordPress

CVE-2026-15441

What is CVE-2026-15441?

The WC Product Table Lite plugin for WordPress features a vulnerability that allows unauthenticated attackers to exploit the 'laptop_scroll_offset' shortcode attribute via the wcpt_ajax() AJAX handler. This handler processes attacker-supplied attributes using insufficient validation, only allowing certain key names but not controlling the values themselves. When processed, these values are directly interpolated into inline CSS, creating opportunities for attackers to inject arbitrary CSS styles. This can lead to various attacks including data exfiltration, UI redressing, and phishing attempts that can evade Content Security Policies (CSPs) that permit inline styles.

References