CVE-2026-66436

You need to patch Active Products Tables for WooCommerce version 1.1.1 or earlier immediately — this is an unauthenticated SQL injection with CVSS 9.3, meaning any attacker can execute arbitrary queries against your database without credentials. The vulnerable endpoint has no authentication gate at all, which is typical of this class of bug in WooCommerce plugins: the developer never considered that the query path would be reached by anyone other than trusted admin users. But here's what you should actually watch for: the EPSS score of 0.00291 is low, and that likely reflects this plugin's modest install base rather than successful defensive measures. If this were a top-50 WooCommerce plugin with hundreds of thousands of installations, the exploitation probability would be substantially higher regardless of patch cadence. Low EPSS on a niche plugin often means

Reviewed through automated stages and approved by a human before publication.