CVE-2026-15441 describes a CSS Injection vulnerability in the WC Product Table Lite plugin for WordPress versions up to 5.6.0. The vulnerability arises from the 'laptop_scroll_offset' shortcode attribute processed by the unauthenticated AJAX handler wcpt_ajax() (registered as wp_ajax_nopriv_wcpt_ajax). The handler JSON-decodes attacker-supplied attributes and only allowlists key names but not values. It applies a preg_replace that strips only square brackets and angle brackets, then passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is directly interpolated into inline CSS properties without numeric casting or CSS escaping. This allows injection of arbitrary CSS declarations, which can be exploited for data exfiltration via CSS attribute selectors and background-image URLs, UI redressing, and phishing that can bypass CSPs permitting inline styles.

The vulnerability allows unauthenticated attackers to inject arbitrary CSS on affected pages, which can be leveraged to exfiltrate data, manipulate the user interface, or conduct phishing attacks that bypass certain Content Security Policies. There is no direct impact on confidentiality or availability beyond the injection of CSS and its potential misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the affected shortcode or the sticky sidebar feature to mitigate risk. Monitor vendor channels for updates and apply official patches once released.