The Active Woot Products Tables for WooCommerce plugin for WordPress contains a stored cross‑site scripting flaw in the help_title shortcode attribute. The input is not properly sanitized or escaped before being stored and later rendered, allowing an attacker with contributor‑level or higher WordPress permissions to inject arbitrary JavaScript that will execute whenever a page containing the shortcode is viewed, potentially defacing the site or hijacking user sessions.

Any WordPress installation running the Active Woot Products Tables for WooCommerce plugin version 2.1.5 or earlier, including all releases up to 2.1.5, is affected. The publisher is realmag777. Users with contributor or higher privileges on those installations are vulnerable.

The CVSS score of 6.4 classifies the vulnerability as medium severity. EPSS is unavailable, and the CVE is not listed in CISA KEV. Exploitation requires authenticated access at least at the contributor level, a typical role for content creators. The lack of sufficient input validation and output escaping means a compromised contributor can deliver malicious scripts to unprivileged visitors, exposing the site to cross‑site scripting attacks. While the risk is moderate, any malicious or compromised contributor poses a significant threat.