CVE-2026-34902: WooCommerce Product Table Lite XSS Vulnerability (v4.6.3 & Earlier)

Technical summary

CVE-2026-34902 is a reflected or stored XSS flaw (CWE-79) in WooCommerce Product Table Lite that bypasses authentication requirements. The vulnerability exists in versions up to and including 4.6.3. The attack vector is network-based with low attack complexity, requiring only user interaction (clicking a malicious link or visiting a compromised page). The scope is changed, meaning the attacker can impact resources beyond the vulnerable component itself. With a CVSS 3.1 score of 7.1 (HIGH), the vulnerability carries moderate confidentiality, integrity, and availability impact.

Business impact

E-commerce sites relying on this plugin face direct threats to customer trust and transaction security. Attackers can harvest customer data, inject fake product reviews or pricing, or install malware-delivery scripts that persist across page views. Because WooCommerce powers approximately 38% of all e-commerce sites, widespread use of this plugin means a large attack surface. Remediation delays increase exposure time and regulatory risk under data protection laws (GDPR, CCPA). Brand reputation damage and potential liability for compromised customer information represent significant financial exposure.

Affected systems

WordPress installations using WooCommerce Product Table Lite plugin version 4.6.3 or earlier are affected. The plugin is commonly used on small- to medium-sized e-commerce sites to improve product browsing experience. Sites that have auto-updates disabled or manual update workflows are at highest immediate risk. The vulnerability requires no special server configuration or environment—any standard WordPress + WooCommerce setup is vulnerable.

Exploitability

Exploitation is straightforward and does not require authentication. An attacker crafts a URL or form containing malicious JavaScript, then tricks or socially engineers a site visitor into clicking the link or visiting the page. If the payload is stored (e.g., in a product listing or custom field), it persists and affects every visitor, amplifying impact. No special tools or technical skill are necessary; proof-of-concept payloads are trivial to construct. Public disclosure or vulnerability details will likely accelerate weaponization.

Remediation

Immediately update WooCommerce Product Table Lite to the patched version released after 4.6.3. Verify the update is available through the WordPress plugin repository or the vendor's official channel. Until patching is complete, disable the plugin if it is not essential to operations. Apply input validation and output encoding best practices across all custom WooCommerce code to mitigate similar risks. Consider implementing a Web Application Firewall (WAF) with XSS filtering rules as a temporary compensating control.

Patch guidance

Check the official WooCommerce Product Table Lite plugin page in the WordPress.org repository for the latest version number and release notes. Download and install the update through the WordPress admin dashboard (Plugins > Installed Plugins > Update). Test the update in a staging environment first to confirm compatibility with your theme and other active plugins. Verify that product tables render correctly and that no functionality is broken. Document the patch date and version in your change log for compliance and audit purposes.

Detection guidance

Monitor web server and WAF logs for XSS-pattern strings in URL parameters, POST data, and HTTP headers—look for script tags, event handlers (onerror, onload), and JavaScript protocol prefixes. Review WooCommerce database tables for unexpected JavaScript in product descriptions, short descriptions, or custom fields. Use WordPress security plugins (e.g., Wordfence, Sucuri) to scan for malicious payloads and backdoors. Check browser console errors and network traffic for unexpected external script loads. Enable WordPress debug logging to catch unusual queries or plugin behavior.

Why prioritize this

This vulnerability merits immediate priority due to its network-exploitable nature, low attack complexity, and high CVSS score. The lack of authentication requirement and broad potential impact on customer data elevate it above lower-severity flaws. E-commerce sites handle payment and personal information, making XSS breaches especially damaging. The popularity of WooCommerce means attackers have significant incentive to weaponize exploits. While not yet on the CISA KEV catalog, the high severity and ease of exploitation suggest rapid adoption by threat actors if not addressed quickly.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects a network-exploitable vulnerability requiring minimal attack complexity and no authentication. User interaction is required (someone must click a link or visit a page), which slightly reduces the score. However, the changed scope (ability to affect other systems and users) and the combination of confidentiality, integrity, and availability impacts justify the HIGH rating. This is a moderate-to-critical threat for e-commerce operations but not an emergency-level zero-day.

Frequently asked questions