CVE-2026-3513
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The TableOn WordPress plugin up to version 1.0.4.4 contains a stored XSS vulnerability via shortcode attributes 'class', 'help_link', 'popup_title', and 'help_title'. These attributes are not properly sanitized or escaped before being inserted into HTML, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts.
Risk Assessment
An attacker can inject a malicious script that executes in the browser of any user visiting the infected page, potentially leading to session theft, redirects, or data theft.
Recommendation
Immediately update the TableOn plugin to the latest available version that fixes this vulnerability, and restrict user permissions to the minimum necessary.
Original NVD description (English source)
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and including 1.0.4.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'class', 'help_link', 'popup_title', and 'help_title'. The do_shortcode_button() function extracts these attributes without sanitization and passes them to TABLEON_HELPER::draw_html_item(), which concatenates attribute values into HTML using single quotes without escaping (line 29: $item .= " {$key}='{$value}'"). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.