CVE-2026-15441

Name of the Vulnerable Software and Affected Versions WC Product Table Lite versions prior to 5.6.1

Description An unauthenticated CSS Injection issue exists via the laptop scroll offset shortcode attribute. The wcpt ajax() AJAX handler, registered for wp ajax nopriv wcpt ajax, processes attacker-supplied attributes by JSON-decoding them and applying a filter that only removes specific characters ([ ] < >). The resulting value is passed through do shortcode() into the wcpt style sticky sidebar() function, where it is inserted directly into inline CSS without numeric casting or escaping. This allows unauthenticated attackers to inject arbitrary CSS declarations and rules on pages with a product table and sticky sidebar enabled. This can be used for UI redressing, phishing that bypasses Content Security Policies (CSPs) allowing inline styles, and data exfiltration using attribute-selectors combined with background-image URLs.

Recommendations Update to a version newer than 5.6.0.