The TablePress plugin for WordPress stores table metadata in the database. An authenticated user with Author or higher privileges can edit a table’s name through the ‘table‑name’ parameter. The plugin fails to sanitize or escape this input before rendering it into a table view, creating a stored cross‑site scripting flaw. An attacker who controls the table name can inject arbitrary JavaScript that will run in the browser context of any user who views the affected table, enabling session hijacking, cookie theft, or defacement. The vulnerability is limited to users who can edit tables and does not exploit public users.

The flaw exists in all TablePress releases up to and including version 3.0.4. The product is a WordPress plugin named TablePress – Tables in WordPress made easy, provided by the author tobiasbg. Systems running WordPress with this plugin installed and an honest Author or higher role are susceptible. No specific WordPress core version is required beyond the plugin version.

The CVSS score of 6.4 indicates a medium severity. The EPSS score of less than 1% suggests the likelihood of exploitation is low at the current time. The flaw is not listed in CISA’s KEV catalog. Because the requires authenticated access, the vector is internal or trusted user. Once a trusted user injects malicious code, any other user who views the table will be impacted. The moderate score reflects the loss of confidentiality and integrity if session data is captured, but no direct remote code execution or data exfiltration outside the user session.