Description

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-16T05:16:47.010Z",
  "pubdate": "2026-08-16T05:16:47.010Z",
  "executiveSummary": "The WC Product Table Lite plugin for WordPress in versions up to, and including, 5.6.0 suffers from a CSS Injection vulnerability. This flaw exposes an unauthenticated attack vector capable of injecting arbitrary CSS declarations and rules into pages rendering a product table with a sticky sidebar enabled.\nThe vulnerability stems from improper input sanitization and a lack of numeric casting or CSS escaping within the handling of shortcode attributes. An unauthenticated remote attacker can exploit this weakness to achieve data exfiltration via attribute-selector combined with background-image URLs, UI redressing, and targeted phishing attacks that successfully bypass Content Security Policies (CSPs) permitting inline styles.\nGiven that the endpoint is publicly accessible via the unauthenticated wcpt_ajax() AJAX handler, exploitation requires no prior authentication or elevated privileges, making it a significant risk to affected WordPress deployments utilizing the vulnerable plugin.",
  "technicalDetails": "The vulnerability resides in the WC Product Table Lite plugin for WordPress up to, and including, version 5.6.0. The core issue is exposed through the unauthenticated wcpt_ajax() AJAX handler, which is registered for the wp_ajax_nopriv_wcpt_ajax WordPress action. This handler accepts attacker-supplied attributes, JSON-decodes them, and validates only the key names through an allowlist while failing to properly validate or sanitize the corresponding values.\nDuring processing, the input undergoes an insufficient sanitization step via preg_replace, which strips only specific characters ([ ], <, and >). Following this inadequate filtering, the value is passed through do_shortcode into the wcpt_style__sticky_sidebar() function. Within this function, the 'laptop_scroll_offset' shortcode attribute is interpolated verbatim into inline CSS contexts—specifically within the 'top: {$top}px;' and 'max-height: calc(100vh - {$top}px);' properties—without undergoing numeric casting or proper CSS context-aware escaping.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious HTTP request targeting the exposed wp_ajax_nopriv_wcpt_ajax endpoint. Second, the request payload supplies malicious input via the 'laptop_scroll_offset' shortcode attribute designed to break out of the intended numeric CSS property context. Third, the application processes the input, bypassing the weak preg_replace filter because dangerous characters like curly braces or property delimiters are omitted from the strip list. Fourth, do_shortcode executes and interpolates the attacker's payload directly into the inline CSS generated by wcpt_style__sticky_sidebar(). Finally, when a victim loads a page rendering a product table with a sticky sidebar enabled, the injected CSS rules are rendered by the browser.\nThe post-exploitation impact includes the execution of arbitrary CSS injections, which attackers can leverage for data exfiltration using advanced CSS techniques such as attribute selectors paired with external background-image URLs. Furthermore, the vulnerability enables UI redressing and sophisticated phishing attacks that can effectively bypass Content Security Policies configured to allow inline styles."
}