This flaw allows an injected script via data‑attributes in TablePress to run automatically whenever a page with the affected table is displayed. The vulnerability arises from insufficient sanitisation of the data‑caption, data‑s‑content‑padding, data‑s‑title and data‑footer attributes, which are stored server‑side and rendered on the client. An attacker who can create or edit a table with Contributor‑level or higher access can place malicious code; any user who views the injected page will have the script execute, potentially enabling session hijacking, defacement, or other client‑side attacks. The weakness is classified as CWE‑79, a classic DOM‑based stored cross‑site scripting issue.

The flaw affects the TablePress plugin for WordPress, any installation of TablePress version 3.1.2 or earlier. The affected product is the "TablePress – Tables in WordPress made easy" plugin available through the WordPress plugin repository. No other vendors or products are listed.

The CVSS score is 6.4, indicating a medium‑severity vulnerability. The EPSS score is below 1 %, which suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitability requires an attacker to authenticate to the WordPress site with Contributor‑level or higher access to create or edit tables. Once the malicious payload is stored in the data‑attributes, any visitor to the page will trigger the script; thus the risk is tied to sites that allow contributions and do not sanitize the attributes. The attack vector is therefore authenticated, role‑based, and the vulnerability can be leveraged to affect all users who access the impacted page.