CVE-2026-66436
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Unauthenticated SQL Injection vulnerability in Active Products Tables for WooCommerce versions up to 1.1.1. An attacker can execute arbitrary SQL queries without authentication.
Risk Assessment
Risk includes unauthorized access to the database, potentially leading to data leakage, modification, or deletion.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious queries.
Other vulnerabilities in Active Products Tables for WooCommerce
See all- CVE-2026-42761Critical
CVE-2026-42761 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.9.
- CVE-2026-42727Critical
CVE-2026-42727 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.8.
- CVE-2026-57409High
The Active Products Tables for WooCommerce plugin (versions up to and including 1.1.0) contains a DOM-based XSS vulnerability due to improper input neutralization during page generation. This allows an attacker to inject malicious client-side scripts.
Original NVD description (English source)
Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS