An attacker able to inject malicious JavaScript via query parameters or form fields can trigger reflected XSS in the WP Table Builder plugin. The flaw arises from improper input neutralization during web page construction, allowing arbitrary script execution in the context of the victim’s browser. This can lead to session hijacking, cookie theft, or delivery of further malware, compromising user confidentiality and integrity.

WordPress sites running the WP Table Builder plugin version 2.0.5 or earlier are affected. The issue applies to all installations of the plugin from its first release up to and including version 2.0.5.

The CVSS v3.1 score is 7.1, indicating a high severity for a reflected XSS vulnerability. The EPSS score is less than 1%, suggesting a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attacker model requires that the user visits a crafted URL or submits a crafted form input. No elevated privileges are needed, making the attack vector plausible for public web sites.