CVE-2026-115611

HighCVSS 7.1

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Summary

The TableOn plugin (posts-table-filterable) by PluginUs.Net contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 1.0.7.

Risk Assessment

An attacker can trick a user into clicking a crafted link and execute a script in the victim's browser within the site context, potentially leading to session theft or actions performed on behalf of the victim.

Recommendation

Update the TableOn plugin to a version newer than 1.0.7. If no fix is available, consider disabling the plugin.

Other vulnerabilities in TableOn

CVE-2026-18881High
The TableOn – WordPress Posts Table Filterable plugin for WordPress up to version 1.0.5.1 is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action. The value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS