High severity · published Dec 10, 2024
CVE-2024-10959
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth
7.3
CVSS
0.6%
EPSS
No
On KEV
Description
The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_get_smth AJAX action in all versions up to, and including, 1.0.6.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Active Products Tables for WooCommerce. Use constructor to create tables · realmag777
through 1.0.6.5 · source: vendor
AP
Active Products Tables For Woocommerce · Realmag777
through 1.0.6.5 · source: CISA
Affected product
AP
Active Products Tables for WooCommerce. Use constructor to create tables
realmag777
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10959
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10959
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1666
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3199368/
wordpress.org
https://wordpress.org/plugins/profit-products-tables-for-woocommerce/#developers
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf803cf-1b9c-4d2e-863f-d1f51b08f833?source=cve
More from Active Products Tables for WooCommerce. Use constructor to create tables
7.3
CVE-2025-1514
Active Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter Call
6.1
CVE-2025-0864
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting
5.4
CVE-2024-10168
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode