The WooCommerce Product Table Lite plugin suffers from a missing capability check in the wcpt_presets__duplicate_preset_to_table function, enabling authenticated users with subscriber or higher privileges to change arbitrary post titles. This unauthorized modification can be exploited to inject stored cross-site scripting payloads that execute when an admin views the product table. The vulnerability affects all versions up to 3.5.1 and is classified under CWE-862 (Missing Authorization).

An attacker with subscriber-level access or higher can modify post titles without authorization, potentially injecting malicious scripts that execute in the context of an administrator viewing the WooCommerce Product Table. This can lead to stored cross-site scripting attacks, compromising administrative accounts or site integrity. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates and apply any forthcoming official patches promptly. Until a fix is released, restrict subscriber-level user capabilities where possible and limit access to trusted users to reduce risk.