# Saphali Woocommerce Lite <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Catalogue Column Count Setting

- **ID:** WPSEC-2026-3160
- **Plugin:** Saphali Woocommerce Lite (`saphali-woocommerce-lite`), https://wordpress.org/plugins/saphali-woocommerce-lite/
- **Affected versions:** from 2.0.0 before 2.0.3
- **Fixed in:** 2.0.3 (Update to 2.0.3 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/saphali-woocommerce-lite
- **Fix released:** 2026-11-14
- **Published:** 2026-11-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3160/

## Description

The Saphali Woocommerce Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0.0 up to, and including, 2.0.2. This is due to a nonce check on the plugin's settings page that is skipped whenever a 'saphali_save_fields' or 'saphali_reset_fields' parameter is present, and to the catalogue column count handler having no nonce check of its own. The submitted value is stored without sanitization and printed without escaping in the settings form. This makes it possible for unauthenticated attackers to change the catalogue column count setting and inject arbitrary web scripts into the plugin's settings page via a forged request, provided they can trick a site administrator or shop manager into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-3160/
- https://plugins.svn.wordpress.org/saphali-woocommerce-lite/tags/2.0.3/
- https://wordpress.org/plugins/saphali-woocommerce-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3160/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.