Product Table & List Builder for WooCommerce

Product Table & List Builder for WooCommerce has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 12 are fixed as of October 2026. Their average CVSS score is 6.2, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 5 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Code Injection, behind 3 of the records (25%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 12 issues recorded for Product Table & List Builder for WooCommerce has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (2) reported by Kévin Mosbahi (Mika).

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Product Table & List Builder for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-2232

Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter

Read the full analysis

Vulnerability Records

12 records


2026-09-24 00:00	Product Table & List Builder for WooCommerce <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting Product Table & List Builder… <= 5.6.7	`CVE-2026-96814`	7.2 High	Asim Alshaya	Yes
2026-08-15 16:15	Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter Product Table & List Builder… <= 5.6.0	`CVE-2026-15441`	5.3 Medium	Wordfence PRISM	Yes
2026-04-07 00:00	Product Table and List Builder for WooCommerce Lite <= 4.6.3 - Unauthenticated Stored Cross-Site Scripting Product Table & List Builder… <= 4.6.3	`CVE-2026-34902`	7.2 High	daroo	Yes
2026-02-18 00:00	Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter Product Table & List Builder… <= 4.6.2	`CVE-2026-2232`	7.5 High	bashu	Yes
2025-04-16 00:00	WooCommerce Product Table Lite <= 3.9.5 - Missing Authorization Product Table & List Builder… <= 3.9.5	`CVE-2025-39602`	5.3 Medium	Kévin Mosbahi (Mika)	Yes
2025-01-30 20:38	WooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting Product Table & List Builder… <= 3.9.4	`CVE-2024-13472`	7.3 High	Michael Mazzolini	Yes
2025-01-24 00:00	WooCommerce Product Table Lite <= 3.8.7 - Missing Authorization Product Table & List Builder… <= 3.8.7	`CVE-2025-24596`	5.3 Medium	Kévin Mosbahi (Mika)	Yes
2024-11-19 00:00	WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting Product Table & List Builder… <= 3.8.6	`CVE-2024-10899`	7.3 High	Arkadiusz Hydzik	Yes
2024-08-07 00:00	WooCommerce Product Table Lite <= 3.5.1 - Unauthenticated Arbitrary Shortcode Execution Product Table & List Builder… <= 3.5.1	`CVE-2024-43128`	4.8 Medium	stealthcopter	Yes
2024-07-26 00:00	WooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting Product Table & List Builder… <= 3.5.1	`CVE-2024-6458`	6.4 Medium	Lucio Sá	Yes

Showing 1–10 of 12 reports