CVE-2026-34902: WordPress WooCommerce Product Table Lite plugin <= 4.6.3 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability exists in the WooCommerce Product Table Lite WordPress plugin at version 4.6.3 and earlier. The flaw is reachable over the network without any authentication, but requires a victim to interact with a malicious link or page crafted by the attacker. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser, enabling session theft, page content modification, or redirection to attacker-controlled sites. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable WordPress site over the network; the plugin exposes the flaw via standard HTTP/HTTPS requests.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated visitor.

• Victim interactionRequired

  A victim must follow a malicious link or visit an attacker-crafted page that triggers the injected script in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning no special conditions, race windows, or environmental factors are required for the exploit to succeed reliably.

Blast Radius

• Reads browser session cookies or authentication tokens belonging to the victim, potentially giving the attacker access to their WordPress or WooCommerce account.
• Injects modified page content into the victim's browser view, enabling phishing forms or fake checkout flows targeting customer payment data.
• Redirects the victim's browser to an attacker-controlled site without their knowledge.
• Degrades the victim's browsing session by executing disruptive scripts, consistent with the partial availability impact indicated in the CVSS vector.