CVE-2026-34902: XSS in Product Table WooCommerce Lite

The impact of this XSS vulnerability is significant. An attacker could inject malicious JavaScript code into the plugin's output, which would then be executed in the browsers of any user visiting a page containing the injected script. This could allow the attacker to steal user cookies, redirect users to phishing sites, or even deface the website. Given the plugin's functionality – displaying product tables – this vulnerability could affect numerous pages across an e-commerce site, significantly expanding the attack surface. The lack of authentication required to exploit the vulnerability further increases the risk, as any visitor can potentially trigger the attack.

1. Published2026-04-07
2. Modified2026-04-13

The primary mitigation for CVE-2026-34902 is to immediately upgrade the Product Table and List Builder for WooCommerce Lite plugin to version 4.6.4 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input. Specifically, look for patterns indicative of JavaScript injection attempts. Additionally, carefully review any user-supplied data used within the plugin and ensure proper input sanitization and output escaping are implemented. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the plugin’s input fields and verifying that the script does not execute.

Active installs

10KNiche

Plugin rating

4.9

Requires WordPress

4.9+

Compatible up to

7.0.0

Requires PHP

7.4+