CVE-2024-10959

The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_get_smth AJAX action in all versions up to, and including, 1.0.6.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

• CWE-94

• https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1666
• https://plugins.trac.wordpress.org/changeset/3199368/
• https://wordpress.org/plugins/profit-products-tables-for-woocommerce/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf803cf-1b9c-4d2e-863f-d1f51b08f833?source=cve

Published

Dec 10, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10953An authenticated data.all user is able to perform mutating U…5.3
• CVE-2024-10954In the `manim` plugin of binary-husky/gpt_academic, versions…8.8
• CVE-2024-10955A Regular Expression Denial of Service (ReDoS) vulnerability…6.5
• CVE-2024-10956GPT Academy version 3.83 in the binary-husky/gpt_academic re…7.1
• CVE-2024-10957The UpdraftPlus: WP Backup & Migration Plugin plugin for Wor…8.8
• CVE-2024-10958The The WP Photo Album Plus plugin for WordPress is vulnerab…7.3
• CVE-2024-1096Twister Antivirus v8.17 is vulnerable to a Denial of Service…5.5
• CVE-2024-10960The Brizy – Page Builder plugin for WordPress is vulnerable …8.8
• CVE-2024-10961The Social Login plugin for WordPress is vulnerable to authe…9.8
• CVE-2024-10962The Migration, Backup, Staging – WPvivid plugin for WordPres…8.8
• CVE-2024-10963A flaw was found in pam_access, where certain rules in its c…7.4
• CVE-2024-10964A vulnerability classified as critical has been found in emq…9.8