PT-2025-2187 · WordPress · Woocommerce Product Table Lite

Michael Mazzolini + 1 · Published 2025-01-31 · Updated 2025-02-11 · CVE-2024-13472

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WooCommerce Product Table Lite plugin for WordPress versions up to, and including, 3.9.4

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do shortcode(). The same sc attrs parameter is also vulnerable to Reflected Cross-Site Scripting. This makes it possible for attackers to execute arbitrary shortcodes.

Recommendations For versions up to, and including, 3.9.4, update to a version later than 3.9.4 to resolve the issue. As a temporary workaround, consider restricting access to the sc attrs parameter to minimize the risk of exploitation. Avoid using the sc attrs parameter in affected shortcodes until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-13472

Affected Products

Woocommerce Product Table Lite

References · 10

• https://plugins.trac.wordpress.org/changeset/3231930 · Patch
• https://osv.dev/vulnerability/CVE-2024-13472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13472 · Security Note
• https://t.me/cvenotify/110950 · Telegram Post
• https://t.me/cvedetector/16930 · Telegram Post
• https://t.me/cvenotify/109382 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4f1a1171-3d7b-46a4-982e-fe318e3017b7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wc-product-table-lite/trunk/main.php#L1843 · Note
• https://twitter.com/CVEnew/status/1885261377977082093 · Twitter Post
• https://wordpress.org/plugins/wc-product-table-lite/#developers · Note