CVE-2026-96814

Executive Summary

CVE-2026-96814 is an unauthenticated Reflected/Stored Cross-Site Scripting (XSS) vulnerability affecting the WooCommerce Product Table Lite WordPress plugin in versions up to and including 5.6.7. Because exploitation requires no authentication, any remote attacker who can induce a victim to submit or visit a crafted request can execute arbitrary JavaScript in the context of the victim's browser session. The impact is limited in direct server compromise but significant for session hijacking, credential theft, and drive-by content injection against WordPress/WooCommerce storefronts, reflected in a CVSS v3.1 base score of 7.1.

Technical Analysis

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The NVD description states the flaw is an unauthenticated XSS in the WooCommerce Product Table Lite plugin for versions <= 5.6.7.

Cross-Site Scripting arises when user-controllable input is embedded into an HTML response without adequate output encoding or contextual sanitization. In the WordPress plugin ecosystem, XSS in a product-display plugin typically occurs where a parameter, shortcode attribute, or rendered field is echoed into the page body without escaping. Because the advisory explicitly states "unauthenticated," the vulnerable input path is reachable without a valid session or elevated role — meaning it is exposed to anonymous visitors or can be triggered by crafted requests sent to a public-facing endpoint.

Key technical attributes established by the available data:

• Vulnerability class: Cross-Site Scripting (CWE-79). The XSS executes within the browser of the victim who renders the affected page.
• Authentication requirement: None (PR:N). No login or privilege is needed to reach the vulnerable code path.
• User interaction: Required (UI:R). The victim must load a page or interact with a request that delivers the malicious content, consistent with the CVSS vector.
• Scope change: The vector includes S:C (Scope: Changed), meaning the vulnerable component can affect resources beyond its own security scope — the injected script executes in the broader origin/context of the hosting WordPress site, potentially affecting authenticated sessions (e.g., administrator cookies).
• Confidentiality / Integrity / Availability: All rated Low (C:L/I:L/A:L), matching the typical impact profile of script injection that does not directly crash or modify server-side data.

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE, and no patch has been released by any tracked source. The precise vulnerable parameter, function, or endpoint is not disclosed in the provided advisory data; therefore the attack surface is described at the vulnerability-class level rather than by fabricated implementation details.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (unauthenticated XSS) and the advisory wording.

1. Reconnaissance / Target Identification An attacker enumerates WordPress sites by fingerprinting the presence of the WooCommerce Product Table Lite plugin. This can be done passively via search engines using plugin-path fingerprints or actively by requesting known plugin asset locations and observing version-specific responses (version <= 5.6.7 is vulnerable). Because the flaw is unauthenticated, no credential harvesting is required at this stage.

2. Triggering the Flaw Class The attacker crafts a request in which attacker-controlled input is delivered to the component that renders a product table. Because the advisory confirms the vulnerability is unauthenticated and falls under CWE-79, the input is reflected or stored into the generated HTML without proper encoding. The specific parameter or rendering field is not disclosed. The attacker delivers this crafted request either directly (reflected variant) or by persisting the payload into a location later rendered to other users (stored variant).

3. Payload / Execution Method (class level) The attacker supplies a script payload that, when the victim's browser renders the affected page, executes in the origin of the vulnerable WordPress site. Execution can be triggered simply by inducing a victim to visit a crafted link or load a page containing the injected content. This aligns with CVSS UI:R and S:C — the script runs in a context that can reach beyond the immediate HTML fragment.

4. Post-Exploitation Impact Successful execution yields script control in the victim's browser session. Consistent with C:L/I:L/A:L, realistic outcomes include:

   • Session/cookie theft, enabling account takeover if a privileged user (e.g., a store administrator) views the injected page.
   • Forced actions (CSRF-style) performed as the victim via same-origin AJAX requests.
   • Injection of fraudulent content, credential-harvesting forms, or malvertising into the storefront.
   • Pivoting toward administrator compromise, since Scope is Changed (S:C), potentially exposing the wider WordPress/WooCommerce administrative surface. There is no evidence of server-side code execution or data destruction; blast radius is bounded by the browser session and any actions that session can perform.

Impact Assessment

• Business impact: A vulnerable WooCommerce storefront can be weaponized against its own customers and staff. Injected scripts can steal sessions, redirect buyers, display counterfeit payment prompts, or deface storefront content — directly harming customer trust, PCI-adjacent payment journeys, and brand reputation.
• Affected systems: Any WordPress installation running WooCommerce Product Table Lite version 5.6.7 or earlier. Large e-commerce fleets and multi-site deployments amplify exposure.
• Blast radius: Because authentication is not required (PR:N) and scope is changed (S:C), a single crafted request can affect any user who renders the poisoned page, including privileged users. This creates an escalation path from an anonymous external request to administrative session compromise.
• CVSS subscores: AV:N (remotely reachable), AC:L (no special conditions), PR:N (unauthenticated), UI:R (victim interaction needed), S:C (crosses security scope), C:L/I:L/A:L (low confidentiality, integrity, and availability impact). The combination yields 7.1 High — serious but requiring victim interaction.
• Exploitability posture: No public exploit, no Nuclei template, no KEV listing, and EPSS not yet scored. Current exploitation risk is assessed as moderate — low barrier to entry but no observed weaponization to date.

Detection Guidance

Sigma Rule

title: Possible Unauthenticated XSS Exploitation - WooCommerce Product Table Lite
id: 3f9c1a2e-7b64-4d1e-9a10-202696814cve
status: experimental
description: Detects requests containing script/event-handler payloads targeting WooCommerce Product Table Lite (<= 5.6.7), consistent with CVE-2026-96814 unauthenticated XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96814
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'woocommerce-product-table'
      - 'product_table'
      - 'product-table'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'document.cookie'
      - '<svg/onload'
      - 'alert('
  condition: selection_plugin and selection_payload
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate product search strings containing angle brackets
level: high

YARA Rule

rule CVE_2026_96814_WooCommerce_ProductTable_XSS
{
    meta:
        description = "Detects XSS payload patterns targeting WooCommerce Product Table Lite (<= 5.6.7)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96814"
        date = "2026-01-01"
        severity = "high"

    strings:
        $plugin1 = "woocommerce-product-table" ascii nocase
        $plugin2 = "product-table-lite" ascii nocase
        $xss1 = "<script" ascii nocase
        $xss2 = "onerror=" ascii nocase
        $xss3 = "onload=" ascii nocase
        $xss4 = "javascript:" ascii nocase
        $xss5 = "<svg" ascii nocase
        $xss6 = "document.cookie" ascii nocase
        $enc1 = "%3Cscript" ascii nocase
        $enc2 = "%3Csvg" ascii nocase

    condition:
        (any of ($plugin*)) and (2 of ($xss*) or any of ($enc*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96814 WooCommerce Product Table Lite Unauthenticated XSS Attempt"; flow:to_server,established; http.uri; content:"woocommerce-product-table"; nocase; http.uri; content:"<script"; nocase; http.uri; content:"onerror="; nocase; classtype:web-application-attack; reference:cve,2026-96814; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96814; sid:20269681; rev:1;)

alert http any any -> any any (msg:"CVE-2026-96814 WooCommerce Product Table Lite XSS Encoded Payload"; flow:to_server,established; http.uri; content:"woocommerce-product-table"; nocase; http.uri; content:"%3Cscript"; nocase; classtype:web-application-attack; reference:cve,2026-96814; sid:20269682; rev:1;)

Elastic Detection

sequence by source.ip, user_agent.original with maxspan=5s
  [ network where network.protocol == "http" and
      url.query contains "woocommerce-product-table" ]
  [ network where network.protocol == "http" and
      ( url.query contains "<script" or
        url.query contains "%3Cscript" or
        url.query contains "onerror=" or
        url.query contains "onload=" or
        url.query contains "javascript:" ) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=access_log
| eval uri_query = lower(coalesce(uri_query, cs_uri_query, ""))
| where (like(uri_query, "%woocommerce-product-table%") OR like(uri_query, "%product-table%"))
    AND (like(uri_query, "%<script%")
      OR like(uri_query, "%3cscript%")
      OR like(uri_query, "%onerror=%")
      OR like(uri_query, "%onload=%")
      OR like(uri_query, "%javascript:%")
      OR like(uri_query, "%document.cookie%"))
| stats count min(_time) as first_seen max(_time) as last_seen
    values(uri_query) as payloads by src_ip, uri_path, useragent
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,woocommerce,">
  <rule id="2026968" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>woocommerce-product-table|product-table-lite</match>
    <regex type="pcre2">(?i)(%3Cscript|<script|onerror=|onload=|javascript:|document\.cookie)</regex>
    <description>CVE-2026-96814: Possible unauth XSS attempt against WooCommerce Product Table Lite (<= 5.6.7)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, and no vendor fix or official workaround has been published. Operators must treat this as an unpatched vulnerability and apply compensating controls.

1) Immediate Mitigations

• Deploy a Web Application Firewall (WAF) with XSS rulesets tuned to inspect query strings and POST bodies for script and event-handler payloads directed at the plugin's endpoints.
• Virtual patch at the reverse proxy/edge layer to reject or sanitize requests containing <script, %3Cscript, onerror=, onload=, or javascript: in parameters targeting the plugin.
• Enable WordPress Content Security Policy (CSP) headers to restrict inline script execution and reduce payload impact.
• Restrict administrative and editorial sessions, and consider HTTP-only / SameSite cookies to blunt session theft.
• Closely monitor for anonymous or unusual tampering with product table output.

2) Patch / Upgrade Steps

• No patched version currently exists. Monitor the plugin vendor's changelog and the WordPress plugin repository for a release beyond 5.6.7 addressing CVE-2026-96814.
• Once a fixed version is released, upgrade woocommerce-product-table-lite immediately across all sites.
• If no patch is forthcoming, evaluate removing or replacing the plugin, or disabling the affected product-table functionality until a fix is available.

3) Long-Term Hardening

• Maintain an inventory of WordPress plugins and versions; enforce a patch SLA for internet-facing components.
• Apply the principle of least privilege to WordPress roles and limit administrative access.
• Centralize web access logging and forward to SIEM with the detection rules above enabled.
• Perform periodic security reviews and input-output encoding audits on any plugin that renders user-supplied or shortcode-supplied content.

References

1. NVD — CVE-2026-96814: https://nvd.nist.gov/vuln/detail/CVE-2026-96814
2. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
5. WordPress Plugin Security Guidance (hardening and vulnerability reporting): https://developer.wordpress.org/plugins/security/

Note: CVE-2026-96814 is not listed in CISA KEV. No public PoC, exploit code, or tracked threat-actor campaign currently exists for this CVE, and EPSS has not yet assigned a score.