This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the 'Active Products Tables for WooCommerce. Use constructor to create tables' WordPress plugin. Specifically, the 'shortcodes_set' parameter is not properly sanitized or escaped, allowing reflected cross-site scripting attacks. This can lead to execution of arbitrary scripts in the context of the victim's browser when they interact with a maliciously crafted link. The vulnerability affects all plugin versions up to 1.0.6.6. There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or manipulation of user interactions. The CVSS score of 6.1 reflects a medium severity with low confidentiality and integrity impact and no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or applying manual input sanitization and output escaping if feasible. Monitor the vendor's channels for updates or patches addressing this vulnerability.