The vulnerability allows an unauthenticated attacker to supply arbitrary values to the "laptop_scroll_offset" shortcode attribute through the publicly accessible wcpt_ajax() AJAX handler. The handler allowlists only key names and removes the characters [ ] < > from the supplied value, but does not cast the value to a number or escape it for CSS. The value then flows directly into inline CSS declarations for "top" and "max-height" inside the sticky sidebar style block, which are interpolated verbatim by wp_do_shortcode. Because the CSS is inserted into the page without sanitisation, attackers can inject arbitrary CSS rules, including selectors that target hidden elements or background-image URLs that can exfiltrate sensitive data, and can manipulate the page layout to facilitate phishing or UI redressing attacks. The direct impact is the ability to modify the presentation of product‑table pages that have sticky sidebar enabled and to bypass restrictive CSPs that otherwise block problematic inline styles.

The WordPress plugin "Product Table & List Builder For WooCommerce" (wcproducttable) is affected in all released versions up to and including 5.6.0. Users installing any of those versions are vulnerable to the CSS injection described above.

With a CVSS base score of 5.3 the vulnerability is rated medium in severity. The exploit does not require authentication and can be triggered by anyone who can access the site's AJAX endpoint, but it is limited to pages that render a product table with the sticky sidebar feature active. EPSS data is not available and the issue is not listed in CISA KEV, suggesting that large‑scale exploitation is currently unlikely, yet the potential for phishing, UI redressing, and data exfiltration through CSS makes it a risk worth addressing promptly.