CVE-2024-10899: 
WordPress vulnerability analysis and mitigation

The WooCommerce Product Table Lite plugin for WordPress contains a vulnerability (CVE-2024-10899) that affects all versions up to and including 3.8.6. The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation of values before running do_shortcode. Additionally, the same 'id' parameter is vulnerable to Reflected Cross-Site Scripting (Wordfence).

The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The issue is classified as CWE-94 (Improper Control of Generation of Code) and stems from the plugin's failure to properly validate input before executing the do_shortcode function (NVD).

The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes on affected WordPress installations. Additionally, the affected 'id' parameter can be exploited for Reflected Cross-Site Scripting attacks, potentially compromising website security and user data (Wordfence).

Users should update their WooCommerce Product Table Lite plugin to a version newer than 3.8.6 as soon as possible. The vulnerability has been patched in subsequent releases (WordPress Plugin).