The vulnerability lies in insufficient input sanitization and output escaping on attributes of the tableon_popup_iframe_button shortcode in the TableOn – WordPress Posts Table Filterable plugin. The plugin allows any authenticated user with contributor privileges or higher to inject arbitrary scripts into the shortcode. When a user browses a page containing that shortcode, the stored malicious script executes with the context of the viewing user. This can lead to theft of session cookies, defacement, or execution of other malicious actions. This flaw is classified as a Stored Cross‑Site Scripting (CWE‑79).

The affected product is the TableOn – WordPress Posts Table Filterable plugin developed by realmag777. All released versions up to and including 1.0.4.1 are vulnerable, as indicated by the plugin's change log and source code. The plugin is a WordPress plugin and is deployed on any WordPress installation where it has been activated. No other WordPress core components are directly impacted.

The CVSS score is 6.4, indicating a medium severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers need authenticated access at least at the contributor role, so they must either compromise a user account or exploit a credential or social engineering scenario. Once the malicious shortcode is persisted, any user viewing the affected page will execute the injected script, potentially escalating the impact within the site.