CVE-2026-15441 describes a CSS Injection vulnerability in the WC Product Table Lite plugin for WordPress versions up to and including 5.6.0. The vulnerability arises because the 'laptop_scroll_offset' shortcode attribute is processed by an unauthenticated AJAX handler (wp_ajax_nopriv_wcpt_ajax) that JSON-decodes attacker-supplied attributes, only filters key names but not values, and applies a limited preg_replace that strips only certain characters ([ ] < >). The value is then passed through do_shortcode into a function that injects it verbatim into inline CSS properties without numeric casting or CSS escaping. This allows attackers to inject arbitrary CSS declarations and rules on pages with sticky sidebar enabled, potentially enabling data exfiltration via CSS attribute selectors and background-image URLs, UI redressing, and phishing that can bypass CSPs permitting inline styles.

The vulnerability allows unauthenticated attackers to inject arbitrary CSS into pages rendering the product table with sticky sidebar enabled. This can be leveraged for data exfiltration, UI redressing attacks, and phishing campaigns that bypass Content Security Policies allowing inline styles. There is no direct impact on confidentiality or availability, but integrity and user interface trust can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, consider disabling the affected shortcode attribute or the AJAX handler if possible, or disabling the sticky sidebar feature to mitigate the attack surface.