CVE-2026-123183

MediumCVSS 5.3/10Last modified Nov 9, 2026

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.6.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-80

Affected software

Vendor	Product	Versions
PluginUs.Net	Active Products Tables for WooCommerce	<= 2.1.6

References

https://patchstack.com/database/wordpress/plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-plugin-2-1-6-content-injection-vulnerability?_s_id=cve

Timeline

Published: Nov 7, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1231848.1An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a projec CVE-2026-123196.5Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1231968.1Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link host CVE-2026-1231975.3WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted st CVE-2026-1231989.8LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated CVE-2026-1231995.5eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded CVE-2026-12326.8A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Under certain condition CVE-2026-123204.3Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.CVE-2026-1232007.5VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() t CVE-2026-1232015.3Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make t CVE-2026-1232027.5libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a CVE-2026-1232036.1NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying