CVE-2026-57409
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Active Products Tables for WooCommerce plugin (versions up to and including 1.1.0) contains a DOM-based XSS vulnerability due to improper input neutralization during page generation. This allows an attacker to inject malicious client-side scripts.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary JavaScript in the browser of an administrator or user, potentially leading to session theft, content modification, or sensitive data exfiltration.
Recommendation
Immediately update the Active Products Tables for WooCommerce plugin to a version newer than 1.1.0 if available, or apply temporary mitigations such as input and output filtering.
Other vulnerabilities in Active Products Tables for WooCommerce
See all- CVE-2026-66436Critical
Unauthenticated SQL Injection vulnerability in Active Products Tables for WooCommerce versions up to 1.1.1. An attacker can execute arbitrary SQL queries without authentication.
- CVE-2026-42761Critical
CVE-2026-42761 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.9.
- CVE-2026-42727Critical
CVE-2026-42727 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.8.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.1.0.