The Active Products Tables for WooCommerce plugin by realmag777 suffers from a code injection vulnerability (CWE-94) identified as CVE-2024-10959. The flaw arises because the plugin's woot_get_smth AJAX action does not properly validate input before executing do_shortcode, enabling unauthenticated attackers to run arbitrary shortcodes. This vulnerability affects all versions up to and including 1.0.6.5 and can be exploited remotely without authentication, resulting in potential unauthorized code execution within the WordPress environment.

Exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, which can lead to unauthorized code execution. This may compromise the confidentiality, integrity, and availability of the affected WordPress site. The CVSS 3.1 base score is 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official channels from the vendor realmag777 for updates and apply patches promptly once available.