CVE-2024-10168: 
NixOS vulnerability analysis and mitigation

The Active Products Tables for WooCommerce plugin (versions up to 1.0.6.4) contains a Stored Cross-Site Scripting vulnerability through the plugin's woot_button shortcode. The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes (Wordfence).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.4 (Medium), vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability affects authenticated users with contributor-level access and above, who can inject arbitrary web scripts that execute when users access the affected pages (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level privileges to inject malicious scripts that execute in users' browsers when they visit affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the visiting user's browser (NVD).

Users should update to version 1.0.6.5 or later of the Active Products Tables for WooCommerce plugin, which contains the security fix (WordPress Plugin).