The CSV to SortTable WordPress plugin is vulnerable to stored cross‑site scripting through the csv shortcode. Insufficient input sanitization and output escaping allow an authenticated attacker, with Contributor or higher privileges, to inject arbitrary JavaScript that will execute whenever a page containing the injected content is viewed. This can lead to credential theft, session hijacking, or defacement of the site’s front‑end.

WordPress sites that have the CSV to SortTable plugin installed in any version up to and including 4.2.

The CVSS score of 6.4 indicates a moderate severity vulnerability. The EPSS score is less than 1 %, implying a low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Because successful exploitation requires a Contributor‑level authenticated session, the attack surface is limited to users with that level of access. If such a role is granted, the stored XSS can compromise any viewer of the affected page.