PT-2026-139470

CVE-2026-123183

Published

2026-11-07

Updated

2026-11-07

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Active Products Tables for WooCommerce versions prior to 2.1.7

Description An issue exists where the software fails to properly neutralize script-related HTML tags and does not validate values before executing the do shortcode() function. This allows unauthenticated attackers to perform code injection and execute arbitrary shortcodes.

Recommendations Update to a version newer than 2.1.6.

Exploitability

Fix

Impacts

Researchers

Clapboiz

Pham Cong Lap

Vendors

Affected products

Weakness enumeration

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Related identifiers