The TablePress plugin allows users to create tables in WordPress by inserting a shortcode that accepts attributes. When these attributes are not properly sanitized or escaped, an attacker with contributor level or higher can store arbitrary JavaScript code in a table. Once any user views a page that includes the affected table, the injected script runs in the victim’s browser, enabling theft of credentials, session hijacking, or defacement. This vulnerability is a classic stored XSS flaw (CWE‑79).

All installations of the tobiasbg TablePress – Tables in WordPress made easy plugin up to and including version 3.2.4 (the official advisories note the issue exists through 3.2.3), running on any WordPress site that permits contributors to modify tables.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must already possess authenticated contributor or higher access to inject malicious code, making the attack vector internal. If the role permissions are lax, the breadth of impact could extend throughout the site. Nevertheless, the combination of moderate CVSS and low EPSS suggests a lower but still notable risk that should be remediated promptly.