{"id":"CVE-2026-123183","kind":"vulnerability","aliases":["CVE-2026-123183"],"related":[],"title":"WordPress WooCommerce plugin: stored script injection in product tables","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.6.","summary":"Active Products Tables for WooCommerce, a WordPress plugin, fails to neutralize script-related HTML tags on a web page. An attacker can inject script code that runs in visitors' or administrators' browsers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress plugin `profit-products-tables-for-woocommerce` (Active Products Tables for WooCommerce) is installed and at which version.\n- Look at the plugin version in the WordPress admin Plugins screen or the plugin's main file header.","fix":"- Active Products Tables for WooCommerce: versions through `2.1.6` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-07T13:16:36+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:30+00:00","updated_at":"2026-11-07T13:49:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T13:49:30Z","model":"claude-haiku-5-5","output":{"fix":"- Active Products Tables for WooCommerce: versions through `2.1.6` are affected; the sources do not name a fixed version.","reach":"internet","title":"WordPress WooCommerce plugin: stored script injection in product tables","impact":"medium","summary":"Active Products Tables for WooCommerce, a WordPress plugin, fails to neutralize script-related HTML tags on a web page. An attacker can inject script code that runs in visitors' or administrators' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, possibly admin sessions","analyst_note":"Find the vendor advisory or the fixed version for Active Products Tables for WooCommerce and whether auth is required; the NVD entry gives no fixed version.","how_to_check":"- Check whether the WordPress plugin `profit-products-tables-for-woocommerce` (Active Products Tables for WooCommerce) is installed and at which version.\n- Look at the plugin version in the WordPress admin Plugins screen or the plugin's main file header.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Active Products Tables for WooCommerce WordPress plugin at version 2.1.6 or earlier are exposed. The sources do not state the required role or whether the flaw is stored or reflected, so treat any site with the plugin as in scope until the vendor's advisory is read.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4256,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123183':12A,15A '-2026':11A,14A '2.1.6':96C 'activ':22B,72C,88C 'administr':53B 'affect':87C 'allow':83C 'attack':43B 'basic':67C 'browser':54B 'code':47B,84C 'cve':10A,13A 'fail':30B 'host':19B 'html':36B,61C 'improp':55C 'inject':6A,45B 'injection.this':85C 'issu':86C 'n/a':94C 'neutral':32B,56C 'packag':16B 'page':41B,66C 'plugin':3A,29B 'pluginus.net':71C 'product':8A,23B,73C,79C,89C 'profit':78C 'profit-products-tables-for-woocommerc':77C 'relat':35B,60C 'run':49B 'script':5A,34B,46B,59C 'script-rel':33B,58C 'self':18B 'self-host':17B 'store':4A 'tabl':9A,24B,74C,80C,90C 'tag':37B,62C 'visitor':51B 'vulner':69C 'web':40B,65C 'woocommerc':2A,20B,26B,76C,82C,92C 'wordpress':1A,21B,28B 'xss':68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Active Products Tables for WooCommerce WordPress plugin at version 2.1.6 or earlier are exposed. The sources do not state the required role or whether the flaw is stored or reflected, so treat any site with the plugin as in scope until the vendor's advisory is read.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123183':12A,15A '-2026':11A,14A 'cve':10A,13A 'inject':6A 'plugin':3A 'product':8A 'script':5A 'store':4A 'tabl':9A 'woocommerc':2A 'wordpress':1A","search_b":"'activ':22B 'administr':53B 'attack':43B 'browser':54B 'code':47B 'fail':30B 'host':19B 'html':36B 'inject':45B 'neutral':32B 'packag':16B 'page':41B 'plugin':29B 'product':23B 'relat':35B 'run':49B 'script':34B,46B 'script-rel':33B 'self':18B 'self-host':17B 'tabl':24B 'tag':37B 'visitor':51B 'web':40B 'woocommerc':20B,26B 'wordpress':21B,28B","search_c":"'2.1.6':96C 'activ':72C,88C 'affect':87C 'allow':83C 'basic':67C 'code':84C 'html':61C 'improp':55C 'injection.this':85C 'issu':86C 'n/a':94C 'neutral':56C 'page':66C 'pluginus.net':71C 'product':73C,79C,89C 'profit':78C 'profit-products-tables-for-woocommerc':77C 'relat':60C 'script':59C 'script-rel':58C 'tabl':74C,80C,90C 'tag':62C 'vulner':69C 'web':65C 'woocommerc':76C,82C,92C 'xss':68C","first_public_at":"2026-11-07T13:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123183","severity":null,"published_at":"2026-11-07T13:16:36+00:00","modified_at":"2026-11-07T13:16:36+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}