{
 "id": "WPSEC-2026-3160",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3160/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3160/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3160/index.md",
 "title": "Saphali Woocommerce Lite <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Catalogue Column Count Setting",
 "description": "The Saphali Woocommerce Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0.0 up to, and including, 2.0.2. This is due to a nonce check on the plugin's settings page that is skipped whenever a 'saphali_save_fields' or 'saphali_reset_fields' parameter is present, and to the catalogue column count handler having no nonce check of its own. The submitted value is stored without sanitization and printed without escaping in the settings form. This makes it possible for unauthenticated attackers to change the catalogue column count setting and inject arbitrary web scripts into the plugin's settings page via a forged request, provided they can trick a site administrator or shop manager into performing an action such as clicking a link.",
 "plugin": {
  "slug": "saphali-woocommerce-lite",
  "name": "Saphali Woocommerce Lite",
  "full_name": "Saphali Woocommerce Lite",
  "wordpress_org": "https://wordpress.org/plugins/saphali-woocommerce-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/saphali-woocommerce-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/saphali-woocommerce-lite"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "2.0.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 2.0.3"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "2.0.3",
 "remediation": "Update to 2.0.3 or later.",
 "fix_released": "2026-11-14T11:41:15+00:00",
 "published": "2026-11-15T11:44:11+00:00",
 "updated": "2026-11-14T16:16:57.950555+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3160/",
  "https://plugins.svn.wordpress.org/saphali-woocommerce-lite/tags/2.0.3/",
  "https://wordpress.org/plugins/saphali-woocommerce-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/saphali-woocommerce-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-15"
 }
}