The vulnerability is an Improper Neutralization of Script‑Related HTML Tags in the RealMag777 TableOn posts‑table‑filterable plugin, allowing attackers to inject arbitrary JavaScript or HTML into the plugin’s output. This can lead to exploitation of the user’s browser, enabling credential theft, defacement, or malicious redirects. The weakness is classified as CWE‑80 and results in a cross‑site scripting vector.

RealMag777’s TableOn posts‑table‑filterable plugin, versions up to and including 1.0.5.1 are affected. The issue is present in all releases prior to and including that version.

The CVSS score of 7.1 indicates a high impact potential, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through unauthenticated or authenticated front‑end input fields that are rendered by the plugin, where an attacker can supply malicious payloads that are not properly escaped.