Table Block by Tableberg plugin allows attackers to inject malicious scripts through improperly escaped input that is stored and later rendered on the site. The stored XSS flaw can be leveraged by anyone who can submit content to the plugin, enabling the execution of arbitrary JavaScript in the browsers of site visitors. This may lead to cookie theft, session hijacking, defacement, or delivery of malicious payloads.

The vulnerability affects all installations of the Table Block by Tableberg version 0.6.10 or earlier, which were released under the author Imtiaz Rayhan. Any WordPress site running the plugin within this version range is susceptible, regardless of the overall WordPress version.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Attackers would need the ability to insert content into the plugin's tables; the attack vector is likely through a privileged or compromised user account that can edit plugin data or via a vulnerable form that accepts unsanitized input. Once the malicious payload is stored and a visitor loads the affected page, the script is executed in the visitor's browser.