The vulnerability enables an attacker to inject and execute arbitrary scripts in the context of users viewing the WooCommerce product table. This can lead to theft of credentials, session hijacking, defacement, or distribution of malware. The weakness is an Unauthenticated Cross Site Scripting flaw that compromises the confidentiality and integrity of visitor data.

WordPress sites using the WooCommerce Product Table Lite plugin from WP Titan Labs, versions 5.6.7 and earlier. The plugin renders product information in tables accessible without authentication, allowing the payload to reach any visitor.

Assigned a CVSS score of 7.1, the vulnerability is classified as High. The EPSS score is not provided, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the lack of authentication means any site exposing the product table is technically vulnerable. Exploitation requires only that a user visits a page containing the table; no additional credentials or user interaction beyond viewing are needed.