CVE-2026-15441 in WC Product Table Lite Plugin
Summary
by MITRE • 08/16/2026
The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
The WC Product Table Lite plugin for WordPress presents a critical cross-site scripting vulnerability through CSS injection in versions up to and including 5.6.0. This flaw resides within the unauthenticated wcpt_ajax() AJAX handler which is registered for wp_ajax_nopriv_wcpt_ajax, making it accessible to any user without authentication. The vulnerability stems from improper input validation and sanitization of the 'laptop_scroll_offset' shortcode attribute that flows through the plugin's processing pipeline.
The technical implementation of this vulnerability demonstrates a classic insecure data handling pattern where the system only validates key names in a whitelist but fails to sanitize the actual values being processed. The plugin JSON-decodes attacker-supplied attributes and applies a minimal filtering mechanism using preg_replace that merely strips square brackets, angle brackets, and other potentially dangerous characters while leaving the core content intact. This approach creates a false sense of security since it doesn't address the fundamental issue of allowing arbitrary input to be directly interpolated into CSS contexts without proper validation or escaping.
When the vulnerable parameter reaches the wcpt_style__sticky_sidebar() function, the unfiltered value gets interpolated verbatim into inline CSS declarations using string interpolation patterns such as 'top: {$top}px;' and 'max-height: calc(100vh - {$top}px);'. This direct injection allows attackers to inject malicious CSS rules that can manipulate page rendering and user experience. The vulnerability operates at the intersection of CWE-79 (Cross-Site Scripting) and CWE-116 (Improper Encoding or Escaping of Output), as it fails to properly escape data before incorporating it into CSS contexts.
The operational impact of this vulnerability extends beyond simple visual manipulation to enable sophisticated attack vectors that can bypass modern security controls. Unauthenticated attackers can leverage this weakness to inject CSS rules that facilitate data exfiltration through attribute-selector based techniques combined with background-image URLs pointing to attacker-controlled resources. The vulnerability also enables UI redressing attacks and phishing attempts that can circumvent Content Security Policy protections that may permit inline styles, since the malicious CSS is injected directly into the document's style context.
The attack surface for this vulnerability includes any WordPress page utilizing the WC Product Table Lite plugin with sticky sidebar functionality enabled and a product table shortcode containing the vulnerable laptop_scroll_offset attribute. This creates a persistent threat vector that can affect multiple pages across a website simultaneously, making it particularly dangerous for e-commerce sites where product tables are commonly used.
Organizations should immediately implement mitigations including patching to versions beyond 5.6.0 where this vulnerability has been addressed, implementing strict input validation and sanitization for all shortcode attributes, and deploying comprehensive monitoring of AJAX endpoints for unusual parameter patterns. Security measures should include validating numeric inputs before CSS interpolation, implementing proper CSS escaping mechanisms, and establishing network-level controls to monitor for suspicious requests targeting the affected AJAX handler. The vulnerability demonstrates the critical importance of proper input validation at multiple layers of application processing, particularly when dealing with dynamic content injection into security-sensitive contexts like CSS rendering.
This vulnerability aligns with ATT&CK technique T1059.006 (Command and Scripting Interpreter: PowerShell) through its exploitation of scripting contexts, and T1566.002 (Phishing: Spearphishing Attachments) through potential data exfiltration capabilities. The weakness also corresponds to ATT&CK tactic TA0001 (Initial Access) and TA0002 (Execution) as it enables unauthorized code injection into web pages that can then execute malicious payloads through CSS-based attack vectors. Organizations implementing security controls should consider the broader implications of such vulnerabilities in plugin ecosystems, particularly where third-party components are integrated into WordPress environments without comprehensive security review processes.
The root cause analysis reveals a fundamental flaw in the plugin's architecture regarding trust boundaries and input handling principles. The system assumes that whitelisting key names provides sufficient protection while failing to implement proper value validation or sanitization, creating an attack surface that can be exploited even when the parameter names themselves are legitimate. This architectural weakness demonstrates the importance of defense-in-depth security practices where multiple validation layers should be implemented rather than relying on single-point protections.
Additional mitigations should include implementing proper numeric casting for CSS values before interpolation, establishing comprehensive logging of AJAX handler requests with suspicious parameter patterns, and conducting regular security audits of plugin code to identify similar input handling vulnerabilities. The vulnerability highlights the need for security-conscious development practices in WordPress plugin creation, emphasizing that even seemingly benign functionality can become attack vectors when proper security controls are not implemented throughout the entire data processing pipeline from input to output rendering.