Product Table and List Builder for WooCommerce Lite <= 4.6.3 - Cross-Site Scripting Stocké Non Authentifié

The impact of this XSS vulnerability is significant. An attacker could inject malicious JavaScript code into the plugin's output, which would then be executed in the browsers of any user visiting a page containing the injected script. This could allow the attacker to steal user cookies, redirect users to phishing sites, or even deface the website. Given the plugin's functionality – displaying product tables – this vulnerability could affect numerous pages across an e-commerce site, significantly expanding the attack surface. The lack of authentication required to exploit the vulnerability further increases the risk, as any visitor can potentially trigger the attack.

E-commerce websites utilizing the Product Table and List Builder for WooCommerce Lite plugin, particularly those running older versions (≤4.6.3), are at significant risk. Shared hosting environments where plugin updates are managed centrally are also at increased risk, as they may be slower to apply security patches.

• wordpress / composer / npm:

grep -r '<script>' /var/www/wordpress/wp-content/plugins/product-table-and-list-builder-for-woocommerce-lite/

• wordpress / composer / npm:

wp plugin list --status=active | grep 'product-table-and-list-builder-for-woocommerce-lite'

• wordpress / composer / npm:

wp plugin update product-table-and-list-builder-for-woocommerce-lite

• generic web: Inspect product table pages for unexpected JavaScript behavior or alerts.

1. 2026-04-07Disclosure

   disclosure

1. Publiée2026-04-07
2. Modifiée2026-04-13

The primary mitigation for CVE-2026-34902 is to immediately upgrade the Product Table and List Builder for WooCommerce Lite plugin to version 4.6.4 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input. Specifically, look for patterns indicative of JavaScript injection attempts. Additionally, carefully review any user-supplied data used within the plugin and ensure proper input sanitization and output escaping are implemented. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the plugin’s input fields and verifying that the script does not execute.

Installations actives

10KNiche

Note du plugin

4.9

Nécessite WordPress

4.9+

Compatible jusqu'à

7.0.0

Nécessite PHP

7.4+