Active Products Tables for WooCommerce vulnerabilities

Unauthenticated SQL Injection vulnerability in Active Products Tables for WooCommerce versions up to 1.1.1. An attacker can execute arbitrary SQL queries without authentication.

CVE-2026-42761 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.9.

CVE-2026-42727 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in the Active Products Tables for WooCommerce plugin in versions from n/a to 1.0.8.

The Active Products Tables for WooCommerce plugin up to version 2.1.3 has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.

The Active Products Tables for WooCommerce plugin (versions up to and including 1.1.0) contains a DOM-based XSS vulnerability due to improper input neutralization during page generation. This allows an attacker to inject malicious client-side scripts.