WP Table Builder accepts HTML input that is not properly escaped when generating page content. This allows an attacker who can create or modify table entries to store malicious scripts that execute in the browser of any user viewing the impacted page, potentially leading to, based on typical XSS behavior, credential theft, session hijacking, or defacement. The vulnerability is a typical stored XSS flaw, classified as CWE‑79.

All WordPress sites running the WP Table Builder plugin version 2.0.12 or earlier are affected. The plugin provides a visual interface for building tables, and its fields accept user‑supplied content that is rendered without sanitization.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % suggests that exploitation is unlikely in the near term, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is stored XSS, which would require the attacker to add or edit a table entry on a site that uses the compromised plugin. Once the malicious content is stored, it is served to all visitors, enabling widespread impact without additional attacker interaction beyond initial content injection.