blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-6458

MEDIUM 6.4 CVSS 3.1
Published
July 27, 2024
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Description

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table.

Affected WordPress components

  • Product Table & List Builder for WooCommerce – Create WooCommerce Product Table Layout Plugin · wc-product-table-lite
    Confirmed match Active
    Up to and including 3.5.1
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • wcproducttable Product Table and List Builder for WooCommerce Lite — Up to and including 3.5.1
  • wcproducttable woocommerce_product_table — Before 3.8.6

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wc-product-table-lite/trunk/presets/presets.php#L120 Product
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3125858%40wc-product-table-lite&new=3125858%40wc-product-table-lite&sfp_email=&sfph_mail= Patch
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fb465-4c72-49a8-af35-ff6d629ff9a0?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record