The Product Table for WooCommerce plugin is vulnerable to reflected cross‑site scripting through the search_key parameter. Because the plugin does not perform sufficient input sanitization or output escaping, an unauthenticated attacker can supply malicious scripts as part of the search_key value. When a user follows a crafted link that includes the unfiltered search_key, the script is rendered in their browser, generating the opportunity for client‑side compromise such as cookie theft, session hijacking or malicious page alteration. The severity is medium, with a CVSS score of 6.1, and the impact can be significant if an attacker successfully tricked a target user into clicking the link.

All instances of the Product Table for WooCommerce plugin by codersaiful that are at version 5.0.8 or earlier are affected. The vulnerability persists in any WordPress installation where this plugin is active and the search_key parameter is utilized for product filtering. No higher or lower versions are known to be impacted.

Because the vulnerability requires user interaction – specifically, clicking a crafted link – it is less likely to be exploited in widespread campaigns. This is reflected in an EPSS score of less than 1 % and the fact that the issue is not listed in the CISA KEV catalog. The CVSS score of 6.1 categorizes it as medium severity, indicating that while the impact can be non‑trivial, accounts for exploiting it rely on social engineering or user victimization.