{"id":"CVE-2026-120579","kind":"vulnerability","aliases":["CVE-2026-120579"],"related":[],"title":"WordPress Woot Products Tables plugin: stored cross-site scripting via help_title","description":"The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'help_title' parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Active Woot Products Tables for WooCommerce WordPress plugin does not sanitize the help_title parameter, so stored script can be injected. The script runs in the browser of anyone who opens an affected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check whether the plugin named Active Woot Products Tables for WooCommerce is installed and its version, which the sources put at `2.1.5` or earlier.","fix":null,"status":"open","published_at":"2026-11-07T13:16:34+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:20+00:00","updated_at":"2026-11-07T13:49:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T13:49:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Woot Products Tables plugin: stored cross-site scripting via help_title","impact":"medium","summary":"The Active Woot Products Tables for WooCommerce WordPress plugin does not sanitize the help_title parameter, so stored script can be injected. The script runs in the browser of anyone who opens an affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, possibly stealing their sessions","analyst_note":"","how_to_check":"- Check whether the plugin named Active Woot Products Tables for WooCommerce is installed and its version, which the sources put at `2.1.5` or earlier.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Active Woot Products Tables for WooCommerce plugin at version 2.1.5 or earlier are exposed. The attacker needs a contributor-level WordPress account, and visitors who open the injected page are the ones whose browsers run the script. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":4261,"output_tokens":487,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120579':16A,19A '-2026':15A,18A '100':68C '2.1.5':93C 'access':113C,129C 'activ':27B,62C 'affect':59B 'anyon':55B 'arbitrari':118C 'attack':108C 'authent':107C 'browser':53B 'contributor':111C 'contributor-level':110C 'cross':8A,78C 'cross-sit':7A,77C 'cve':14A,17A 'due':94C 'escap':101C 'execut':125C 'free':69C 'help':12A,39B,83C 'host':23B 'includ':92C 'inject':47B,117C,131C 'input':97C 'insuffici':96C 'level':112C 'make':103C 'open':57B 'output':100C 'packag':20B 'page':60B,122C,132C 'paramet':41B,85C 'plugin':5A,34B,70C 'possibl':105C 'product':3A,29B,64C 'run':50B 'sanit':37B,98C 'script':10A,44B,49B,80C,120C 'self':22B 'self-host':21B 'site':9A,79C 'store':6A,43B,76C 'tabl':4A,30B,65C 'titl':13A,40B,84C 'user':128C 'version':88C 'via':11A,81C 'vulner':74C 'web':119C 'whenev':126C 'woocommerc':24B,32B,67C 'woot':2A,28B,63C 'wordpress':1A,25B,33B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Active Woot Products Tables for WooCommerce plugin at version 2.1.5 or earlier are exposed. The attacker needs a contributor-level WordPress account, and visitors who open the injected page are the ones whose browsers run the script. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120579':16A,19A '-2026':15A,18A 'cross':8A 'cross-sit':7A 'cve':14A,17A 'help':12A 'plugin':5A 'product':3A 'script':10A 'site':9A 'store':6A 'tabl':4A 'titl':13A 'via':11A 'woot':2A 'wordpress':1A","search_b":"'activ':27B 'affect':59B 'anyon':55B 'browser':53B 'help':39B 'host':23B 'inject':47B 'open':57B 'packag':20B 'page':60B 'paramet':41B 'plugin':34B 'product':29B 'run':50B 'sanit':37B 'script':44B,49B 'self':22B 'self-host':21B 'store':43B 'tabl':30B 'titl':40B 'woocommerc':24B,32B 'woot':28B 'wordpress':25B,33B","search_c":"'100':68C '2.1.5':93C 'access':113C,129C 'activ':62C 'arbitrari':118C 'attack':108C 'authent':107C 'contributor':111C 'contributor-level':110C 'cross':78C 'cross-sit':77C 'due':94C 'escap':101C 'execut':125C 'free':69C 'help':83C 'includ':92C 'inject':117C,131C 'input':97C 'insuffici':96C 'level':112C 'make':103C 'output':100C 'page':122C,132C 'paramet':85C 'plugin':70C 'possibl':105C 'product':64C 'sanit':98C 'script':80C,120C 'site':79C 'store':76C 'tabl':65C 'titl':84C 'user':128C 'version':88C 'via':81C 'vulner':74C 'web':119C 'whenev':126C 'woocommerc':67C 'woot':63C 'wordpress':72C","first_public_at":"2026-11-07T13:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120579","severity":null,"published_at":"2026-11-07T13:16:34+00:00","modified_at":"2026-11-07T13:16:34+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}